Resubmissions
07-01-2025 15:16
250107-sneq2aykej 1007-01-2025 14:48
250107-r6y2ysvrdw 1007-01-2025 14:31
250107-rvyl2swrhr 707-01-2025 14:23
250107-rqb79awqcq 1Analysis
-
max time kernel
900s -
max time network
898s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-01-2025 14:48
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://YouTube.com
Resource
win11-20241007-en
General
-
Target
http://YouTube.com
Malware Config
Extracted
quasar
1.4.1
ROBLOX EXECUTOR
192.168.50.1:4782
10.0.0.113:4782
LETSQOOO-62766.portmap.host:62766
89.10.178.51:4782
90faf922-159d-4166-b661-4ba16af8650e
-
encryption_key
FFEE70B90F5EBED6085600C989F1D6D56E2DEC26
-
install_name
windows 3543.exe
-
log_directory
roblox executor
-
reconnect_delay
3000
-
startup_key
windows background updater
-
subdirectory
windows updater
Extracted
C:\Users\Admin\AppData\Local\Temp\Decryptfiles.txt
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/files/0x001c00000002afce-2335.dat family_quasar behavioral1/memory/1220-2803-0x0000000000980000-0x0000000000CA4000-memory.dmp family_quasar -
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Localized Name = "Brave" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Version = "43,0,0,0" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\ = "Brave" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\StubPath = "\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\131.1.73.104\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" setup.exe -
pid Process 6040 powershell.exe 3232 powershell.exe 4992 powershell.exe 6104 powershell.exe 6060 powershell.exe 4584 powershell.exe 2516 powershell.exe 3796 powershell.exe 3920 powershell.exe 6112 powershell.exe 6100 powershell.exe 5304 powershell.exe 5556 powershell.exe 5252 powershell.exe 5812 powershell.exe 2412 powershell.exe 5048 powershell.exe 3500 powershell.exe 2520 powershell.exe 5216 powershell.exe -
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe BraveUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe\DisableExceptionChainValidation = "0" BraveUpdate.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt Crawl.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Decryptfiles.txt Crawl.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 64 IoCs
pid Process 1220 BraveBrowserSetup-BRV002.exe 3760 BraveUpdate.exe 1020 BraveUpdate.exe 4668 BraveUpdate.exe 884 BraveUpdateComRegisterShell64.exe 4488 BraveUpdateComRegisterShell64.exe 1536 BraveUpdateComRegisterShell64.exe 1464 BraveUpdate.exe 1412 BraveUpdate.exe 3628 BraveUpdate.exe 3468 brave_installer-x64.exe 4668 setup.exe 1112 setup.exe 1068 setup.exe 2376 setup.exe 1264 BraveUpdate.exe 3516 BraveUpdateOnDemand.exe 3200 BraveUpdate.exe 1600 brave.exe 3432 brave.exe 4376 brave.exe 1104 brave.exe 1004 brave.exe 3292 elevation_service.exe 1856 brave.exe 1032 brave.exe 3628 brave.exe 4356 brave.exe 2452 brave.exe 560 brave.exe 1612 brave.exe 3404 brave.exe 3436 brave.exe 8 brave.exe 5036 chrmstp.exe 3384 chrmstp.exe 2104 chrmstp.exe 3092 chrmstp.exe 1264 brave.exe 4900 brave.exe 5100 brave.exe 1564 brave.exe 3664 brave.exe 3960 brave.exe 4776 brave.exe 4604 brave.exe 2036 brave.exe 1060 brave.exe 2484 brave.exe 664 brave.exe 1532 brave.exe 664 brave.exe 5016 brave.exe 5024 brave.exe 2904 brave.exe 2692 brave.exe 1220 brave.exe 5040 brave.exe 1220 JJSPLOIT.V2.exe 4720 brave.exe 5040 windows 3543.exe 4604 brave.exe 3224 brave.exe 4788 brave.exe -
Loads dropped DLL 64 IoCs
pid Process 3760 BraveUpdate.exe 1020 BraveUpdate.exe 4668 BraveUpdate.exe 884 BraveUpdateComRegisterShell64.exe 4668 BraveUpdate.exe 4488 BraveUpdateComRegisterShell64.exe 4668 BraveUpdate.exe 1536 BraveUpdateComRegisterShell64.exe 4668 BraveUpdate.exe 1464 BraveUpdate.exe 1412 BraveUpdate.exe 3628 BraveUpdate.exe 3628 BraveUpdate.exe 1412 BraveUpdate.exe 1264 BraveUpdate.exe 3200 BraveUpdate.exe 3200 BraveUpdate.exe 1600 brave.exe 3432 brave.exe 1600 brave.exe 4376 brave.exe 1104 brave.exe 4376 brave.exe 1104 brave.exe 1004 brave.exe 1004 brave.exe 4376 brave.exe 4376 brave.exe 4376 brave.exe 4376 brave.exe 4376 brave.exe 4376 brave.exe 1856 brave.exe 1856 brave.exe 1032 brave.exe 1032 brave.exe 3628 brave.exe 3628 brave.exe 4356 brave.exe 4356 brave.exe 2452 brave.exe 560 brave.exe 560 brave.exe 2452 brave.exe 1612 brave.exe 3404 brave.exe 1612 brave.exe 3404 brave.exe 3436 brave.exe 3436 brave.exe 8 brave.exe 8 brave.exe 1264 brave.exe 1264 brave.exe 4900 brave.exe 4900 brave.exe 5100 brave.exe 5100 brave.exe 1564 brave.exe 1564 brave.exe 3664 brave.exe 3664 brave.exe 3960 brave.exe 3960 brave.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\XPSUDTARW = "\"C:\\Users\\Admin\\Desktop\\Crawl.exe\"" Crawl.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 4 IoCs
description ioc Process File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Crawl.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Crawl.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Crawl.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Crawl.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 149 raw.githubusercontent.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 273 checkip.amazonaws.com 274 checkip.amazonaws.com -
Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer brave.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName brave.exe -
Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateBroker.exe BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\resources\brave_extension\_locales\kn\messages.json setup.exe File opened for modification C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\setup.exe brave_installer-x64.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_ar.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_el.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\Locales\tr.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\resources\brave_extension\_locales\en_GB\messages.json setup.exe File created C:\Program Files (x86)\FleetDeck Agent\20220420175353\fleetdeck_agent.exe fleetdeck_agent_svc.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShellArm64.exe BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\resources\brave_extension\_locales\id\messages.json setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\brave.exe setup.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_pt-PT.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\chrome.dll setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\resources\brave_extension\_locales\hu\messages.json setup.exe File created C:\Program Files\SystemInformer\dbgcore.dll systeminformer-3.2.25004-release-setup.exe File created C:\Program Files\SystemInformer\plugins\Updater.sig systeminformer-3.2.25004-release-setup.exe File opened for modification C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdate.exe BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_pt-BR.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\psuser_arm64.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\resources\brave_extension\_locales\lt\messages.json setup.exe File created C:\Program Files\SystemInformer\SystemInformer.sys systeminformer-3.2.25004-release-setup.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_fi.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_sr.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\Locales\sv.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\resources\brave_extension\_locales\lv\messages.json setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\resources\brave_extension\_locales\pt_BR\messages.json setup.exe File created C:\Program Files (x86)\FleetDeck Agent\latest.json fleetdeck_agent_svc.exe File opened for modification C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe powershell.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_sw.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\Locales\ro.pak setup.exe File opened for modification C:\Program Files (x86)\BraveSoftware\Update\Download\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\131.1.73.104\brave_installer-x64.exe BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\resources\brave_extension\_locales\ca\messages.json setup.exe File created C:\Program Files (x86)\FleetDeck Agent\deployment.json fleetdeck_agent_svc.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_ru.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_uk.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\resources\brave_extension\_locales\ms\messages.json setup.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_ml.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\Locales\ru.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\Locales\sk.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\Locales\sw.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\MEIPreload\manifest.json setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\resources\brave_extension\_locales\uk\messages.json setup.exe File created C:\Program Files\SystemInformer\plugins\ExtendedServices.sig systeminformer-3.2.25004-release-setup.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_sl.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\Locales\fi.pak setup.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_ta.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\chrome_elf.dll setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\Locales\es.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\Locales\zh-CN.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\resources\brave_extension\_locales\nb\messages.json setup.exe File created C:\Program Files\SystemInformer\ksidyn.sig systeminformer-3.2.25004-release-setup.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_bg.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_mr.dll BraveUpdate.exe File created C:\Program Files\SystemInformer\peview.sig systeminformer-3.2.25004-release-setup.exe File created C:\Program Files\SystemInformer\plugins\ExtendedNotifications.sig systeminformer-3.2.25004-release-setup.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\brave_100_percent.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\resources\brave_extension\_locales\sw\messages.json setup.exe File created C:\Program Files\SystemInformer\plugins\WindowExplorer.sig systeminformer-3.2.25004-release-setup.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\goopdateres_de.dll BraveUpdate.exe File created C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\psuser_64.dll BraveUpdate.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\Locales\de.pak setup.exe File created C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4668_1549636770\Chrome-bin\131.1.73.104\resources\brave_extension\_locales\bg\messages.json setup.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\GUM80B.tmp\psuser_64.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_507982058\manifest.json brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_161333972\minkyeong-shin.jpg brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1992294169\hyph-nb.hyb brave.exe File created C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_am.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_fi.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_442332886\manifest.fingerprint brave.exe File created C:\Windows\SystemTemp\chrome_url_fetcher_1600_1115344184\extension_1_0_283.crx brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1992294169\hyph-gu.hyb brave.exe File created C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_gu.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_ur.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_466911274\abb5f81c-002f-4ffc-b5e3-ecc5d29f7e86.png brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1773847304\1\clean-urls-permissions.json brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_330063610\_metadata\verified_contents.json brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1992294169\hyph-nn.hyb brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_375743047\manifest.json brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1992294169\hyph-en-gb.hyb brave.exe File created C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_pt-BR.dll BraveBrowserSetup-BRV002.exe File opened for modification C:\Windows\SystemTemp\Crashpad\settings.dat setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_161333972\lori-jean.jpg brave.exe File created C:\Windows\SystemTemp\chrome_url_fetcher_1600_14578749\extension_1_0_10543.crx brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1992294169\hyph-es.hyb brave.exe File created C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_es-419.dll BraveBrowserSetup-BRV002.exe File opened for modification C:\Windows\SystemTemp\Crashpad\settings.dat setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1951857099\manifest.json brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1587199246\manifest.json brave.exe File created C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_it.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_uk.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_url_fetcher_1600_1290173351\jflhchccmppkfebkiaminageehmchikm_2025.01.06.01_all_gjrlsulxr5i5e25nf2jzwoxpei.crx3 brave.exe File created C:\Windows\SystemTemp\chrome_url_fetcher_1600_493297333\extension_1_0_15.crx brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1773847304\1\debounce.json brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1587199246\manifest.fingerprint brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_2108726891\brave_metadata\verified_contents.json brave.exe File created C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_hi.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_url_fetcher_1600_1102289275\extension_1_0_1843.crx brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_525795849\list.txt brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1230661125\manifest.json brave.exe File created C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_en.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_442332886\manifest.json brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1992294169\hyph-pt.hyb brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1992294169\hyph-mn-cyrl.hyb brave.exe File created C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_ja.dll BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1773847304\1\scripts\brave_rewards\publisher\twitch\twitchAutoContribution.bundle.js brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1308991235\manifest.json brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1327001734\manifest.fingerprint brave.exe File created C:\Windows\SystemTemp\GUM80B.tmp\goopdateres_no.dll BraveBrowserSetup-BRV002.exe File opened for modification C:\Windows\SystemTemp\chromium_installer.log setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_161333972\spencer-moore-3.jpg brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1308991235\manifest.fingerprint brave.exe File opened for modification C:\Windows\Installer\{B65B4DB7-E2F9-44E1-9592-248ECC2EAE85}\fleetdeck.ico msiexec.exe File created C:\Windows\SystemTemp\GUM80B.tmp\BraveUpdateSetup.exe\:Zone.Identifier:$DATA BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1773847304\1\Greaselion.json brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_226800497\manifest.json brave.exe File created C:\Windows\SystemTemp\GUM80B.tmp\BraveCrashHandler64.exe BraveBrowserSetup-BRV002.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1773847304\1\webcompat-exceptions.json brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1992294169\hyph-or.hyb brave.exe File opened for modification C:\Windows\SystemTemp brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_525795849\brave_metadata\verified_contents.json brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1992294169\hyph-fr.hyb brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1992294169\hyph-bg.hyb brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_466911274\manifest.fingerprint brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_1773847304\1\scripts\brave_rewards\publisher\twitch\twitchBase.bundle.js brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_161333972\manifest.json brave.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1600_466911274\c3a82b87-c30b-45ef-9c2e-255779d9a48a.png brave.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 6 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Desktop\systeminformer-3.2.25004-release-setup.exe:Zone.Identifier brave.exe File opened for modification C:\Users\Admin\Desktop\Crawl.exe:Zone.Identifier brave.exe File opened for modification C:\Users\Admin\Desktop\lifework.exe:Zone.Identifier brave.exe File opened for modification C:\Users\Admin\Desktop\setup.exe:Zone.Identifier brave.exe File opened for modification C:\Users\Admin\Downloads\BraveBrowserSetup-BRV002.exe:Zone.Identifier chrome.exe File opened for modification C:\Users\Admin\Desktop\JJSPLOIT.V2.exe:Zone.Identifier brave.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 31 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdateOnDemand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lifework.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveCrashHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Crawl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fleetdeck_agent_svc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lifework.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminformer-3.2.25004-release-setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BraveBrowserSetup-BRV002.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 16 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4412 PING.EXE 4632 PING.EXE 5052 PING.EXE 5192 cmd.exe 5768 PING.EXE 2248 PING.EXE 308 PING.EXE 2972 PING.EXE 6116 PING.EXE 5248 PING.EXE 5444 PING.EXE 5328 PING.EXE 4584 PING.EXE 1464 BraveUpdate.exe 1264 BraveUpdate.exe 2876 PING.EXE -
Checks SCSI registry key(s) 3 TTPs 33 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters SystemInformer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SystemInformer.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters SystemInformer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities SystemInformer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities SystemInformer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000089ac4f3df1c89d300000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000089ac4f3d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090089ac4f3d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d89ac4f3d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000089ac4f3d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters SystemInformer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags SystemInformer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities SystemInformer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags SystemInformer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 SystemInformer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 SystemInformer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters SystemInformer.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SystemInformer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SystemInformer.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName brave.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer brave.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS brave.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" fleetdeck_agent_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" fleetdeck_agent_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" fleetdeck_agent_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" fleetdeck_agent_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" fleetdeck_agent_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" fleetdeck_agent_svc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" fleetdeck_agent_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" fleetdeck_agent_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" fleetdeck_agent_svc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.PolicyStatusSvc.1.0\CLSID BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91B050A9-5A49-4249-A8C8-B4390961A912}\NumMethods BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebMachine\CLSID BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CFC4E00-1C9D-443D-B5BE-CEEEAC1443AF}\ProxyStubClsid32\ = "{6B042DC7-1633-49A2-8255-7DA828C32CA7}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ brave.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ brave.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CB305B1-4D45-4668-AD91-677F87BED305}\ = "IGoogleUpdate3" BraveUpdate.exe Set value (data) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots brave.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 brave.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CB305B1-4D45-4668-AD91-677F87BED305}\ProxyStubClsid32\ = "{6B042DC7-1633-49A2-8255-7DA828C32CA7}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 brave.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} brave.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3282EB12-D954-4FD2-A2E1-C942C8745C65}\VersionIndependentProgID\ = "BraveSoftwareUpdate.OnDemandCOMClassMachineFallback" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1985533F-9B0F-490A-85C5-24F316E66FB2}\NumMethods\ = "41" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\NumMethods\ = "4" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.151\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.ProcessLauncher\CurVer BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{652886FF-517B-4F23-A14F-F99563A04BCC}\ = "Google Update Policy Status Class" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4842EC21-0860-45B5-99F0-A1E6E7C11561}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}\ProxyStubClsid32\ = "{6B042DC7-1633-49A2-8255-7DA828C32CA7}" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0D2DC5A9-E726-4D6B-BD5E-648F4BDA4930}\InprocHandler32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.151\\psmachine_64.dll" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ brave.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3COMClassService\CLSID BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9190589-ECEC-43F8-8AEC-62496BB87B26}\ = "IGoogleUpdate3Web" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91B050A9-5A49-4249-A8C8-B4390961A912} BraveUpdateComRegisterShell64.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257" brave.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8504FB26-FC3E-4C1C-9C94-46EC93E6BA63}\NumMethods\ = "9" BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{652886FF-517B-4F23-A14F-F99563A04BCC}\VersionIndependentProgID BraveUpdate.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" brave.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\NumMethods\ = "11" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9190589-ECEC-43F8-8AEC-62496BB87B26}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell brave.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FF76E871FB951743958FFF47DDBE8BC\7BD4B56B9F2E1E44592942E8CCE2EA58 msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 brave.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C11C073F-E6D0-4EF7-897B-AAF52498CD2F}\NumMethods\ = "12" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F7FF255A-A593-41BD-A69B-E05D72B72756}\ = "Google Update Core Class" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F396861E-0C8E-4C71-8256-2FAE6D759CE9}\TypeLib\ = "{F396861E-0C8E-4C71-8256-2FAE6D759CE9}" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4842EC21-0860-45B5-99F0-A1E6E7C11561}\ProxyStubClsid32 BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CredentialDialogMachine.1.0 BraveUpdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" brave.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C11C073F-E6D0-4EF7-897B-AAF52498CD2F}\NumMethods BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C929BFE-4FA4-488D-B1E2-82ECD6F076C8}\ = "IGoogleUpdate" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9190589-ECEC-43F8-8AEC-62496BB87B26}\ProxyStubClsid32\ = "{6B042DC7-1633-49A2-8255-7DA828C32CA7}" BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32 BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CoreMachineClass.1\CLSID\ = "{F7FF255A-A593-41BD-A69B-E05D72B72756}" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.PolicyStatusMachineFallback.1.0\ = "Google Update Policy Status Class" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{660130E8-74E4-4821-A6FD-4E9A86E06470}\ProxyStubClsid32\ = "{6B042DC7-1633-49A2-8255-7DA828C32CA7}" BraveUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0D2DC5A9-E726-4D6B-BD5E-648F4BDA4930} BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28C83F57-E4C0-4B54-B187-585C51EE8F9C}\ProgID BraveUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F234546B-DACD-4374-97CF-7BADFAB76766}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{931E73FD-D487-4458-AA08-1FF41413377B}\NumMethods BraveUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{852A0F87-D117-4B7C-ABA9-2F76D91BCB9D} BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35A4470F-5EEC-4715-A2DC-6AA9F8E21183}\ProxyStubClsid32\ = "{6B042DC7-1633-49A2-8255-7DA828C32CA7}" BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CoCreateAsync\CLSID\ = "{8F6D9FE5-6ED3-43A3-80D2-EA8766D65352}" BraveUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{F396861E-0C8E-4C71-8256-2FAE6D759CE9}\ProxyStubClsid32 setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" brave.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4842EC21-0860-45B5-99F0-A1E6E7C11561}\ProxyStubClsid32 BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\NumMethods\ = "4" BraveUpdateComRegisterShell64.exe Key created \Registry\User\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\NotificationData brave.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings brave.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CoreClass BraveUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}\NumMethods\ = "10" BraveUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24D704AD-AC42-49F2-BB4F-68BA77C98E91}\ProxyStubClsid32\ = "{6B042DC7-1633-49A2-8255-7DA828C32CA7}" BraveUpdateComRegisterShell64.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 brave.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e brave.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e brave.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e brave.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e brave.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e brave.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e brave.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e brave.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 brave.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e brave.exe -
NTFS ADS 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\setup.exe:Zone.Identifier brave.exe File opened for modification C:\Users\Admin\Downloads\BraveBrowserSetup-BRV002.exe:Zone.Identifier chrome.exe File created C:\Windows\SystemTemp\GUM80B.tmp\BraveUpdateSetup.exe\:Zone.Identifier:$DATA BraveBrowserSetup-BRV002.exe File opened for modification C:\Users\Admin\Desktop\JJSPLOIT.V2.exe:Zone.Identifier brave.exe File opened for modification C:\Users\Admin\Desktop\systeminformer-3.2.25004-release-setup.exe:Zone.Identifier brave.exe File opened for modification C:\Users\Admin\Desktop\Crawl.exe:Zone.Identifier brave.exe File opened for modification C:\Users\Admin\Desktop\lifework.exe:Zone.Identifier brave.exe -
Opens file in notepad (likely ransom note) 2 IoCs
pid Process 5708 NOTEPAD.EXE 1460 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 13 IoCs
pid Process 5444 PING.EXE 5328 PING.EXE 2972 PING.EXE 6116 PING.EXE 4584 PING.EXE 4412 PING.EXE 2876 PING.EXE 5248 PING.EXE 4632 PING.EXE 308 PING.EXE 2248 PING.EXE 5052 PING.EXE 5768 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1184 schtasks.exe 3960 schtasks.exe 4584 schtasks.exe 3616 schtasks.exe 2240 schtasks.exe 3880 schtasks.exe 5292 schtasks.exe 5828 schtasks.exe 6096 schtasks.exe 1480 schtasks.exe 5408 schtasks.exe 6080 schtasks.exe 3948 schtasks.exe 5540 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 5220 explorer.exe 2692 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4784 chrome.exe 4784 chrome.exe 3760 BraveUpdate.exe 3760 BraveUpdate.exe 3760 BraveUpdate.exe 3760 BraveUpdate.exe 3760 BraveUpdate.exe 3760 BraveUpdate.exe 3760 BraveUpdate.exe 3760 BraveUpdate.exe 1264 BraveUpdate.exe 1264 BraveUpdate.exe 3760 BraveUpdate.exe 3760 BraveUpdate.exe 3760 BraveUpdate.exe 3760 BraveUpdate.exe 1600 brave.exe 1600 brave.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe 132 SystemInformer.exe -
Suspicious behavior: GetForegroundWindowSpam 4 IoCs
pid Process 132 SystemInformer.exe 2692 explorer.exe 1268 brave.exe 2684 brave.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs
pid Process 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: 33 3800 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3800 AUDIODG.EXE Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeDebugPrivilege 3760 BraveUpdate.exe Token: SeDebugPrivilege 3760 BraveUpdate.exe Token: SeDebugPrivilege 3760 BraveUpdate.exe Token: SeDebugPrivilege 3760 BraveUpdate.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: 33 3468 brave_installer-x64.exe Token: SeIncBasePriorityPrivilege 3468 brave_installer-x64.exe Token: SeDebugPrivilege 1264 BraveUpdate.exe Token: SeDebugPrivilege 3760 BraveUpdate.exe Token: SeShutdownPrivilege 1600 brave.exe Token: SeCreatePagefilePrivilege 1600 brave.exe Token: SeShutdownPrivilege 1600 brave.exe Token: SeCreatePagefilePrivilege 1600 brave.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 2104 chrmstp.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe 1600 brave.exe -
Suspicious use of SetWindowsHookEx 30 IoCs
pid Process 664 brave.exe 5040 windows 3543.exe 3752 brave.exe 2124 windows 3543.exe 1408 windows 3543.exe 1972 brave.exe 5784 windows 3543.exe 6136 brave.exe 1060 windows 3543.exe 5560 brave.exe 5240 setup.exe 3948 windows 3543.exe 2340 windows 3543.exe 5220 explorer.exe 5220 explorer.exe 5480 windows 3543.exe 5800 windows 3543.exe 2692 explorer.exe 2692 explorer.exe 1616 brave.exe 1204 windows 3543.exe 1824 brave.exe 5720 windows 3543.exe 1268 brave.exe 5776 windows 3543.exe 3628 brave.exe 2684 brave.exe 3712 brave.exe 5044 brave.exe 5016 windows 3543.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4784 wrote to memory of 2268 4784 chrome.exe 77 PID 4784 wrote to memory of 2268 4784 chrome.exe 77 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3640 4784 chrome.exe 78 PID 4784 wrote to memory of 3200 4784 chrome.exe 79 PID 4784 wrote to memory of 3200 4784 chrome.exe 79 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 PID 4784 wrote to memory of 4764 4784 chrome.exe 80 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://YouTube.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff2c54cc40,0x7fff2c54cc4c,0x7fff2c54cc582⤵PID:2268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1824 /prefetch:22⤵PID:3640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1948,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2108 /prefetch:32⤵PID:3200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2160,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2176 /prefetch:82⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3000,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3008 /prefetch:12⤵PID:2976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3012,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:12⤵PID:2828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3632,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3532 /prefetch:12⤵PID:3552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3020,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:4960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4628,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4284 /prefetch:82⤵PID:1848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4632,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4772 /prefetch:82⤵PID:2376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4912,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4936 /prefetch:82⤵PID:1844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4724,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4884 /prefetch:12⤵PID:3216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3136,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5436 /prefetch:82⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4500,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:2692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5472,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5480 /prefetch:82⤵PID:3600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4436,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5504 /prefetch:82⤵PID:1780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3728,i,17085760660258508479,11384883103505877926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5644 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:3996
-
-
C:\Users\Admin\Downloads\BraveBrowserSetup-BRV002.exe"C:\Users\Admin\Downloads\BraveBrowserSetup-BRV002.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:1220 -
C:\Windows\SystemTemp\GUM80B.tmp\BraveUpdate.exeC:\Windows\SystemTemp\GUM80B.tmp\BraveUpdate.exe /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3760 -
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1020
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4668 -
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:884
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4488
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1536
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntBMTU4NjM3RC05NjI0LTRGQTUtOEI0MS1GRERBOTMzREYyQ0J9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7RUE0NjQwNTUtMEUzRC00RTk4LUI0QjgtMjQyRTkxMUIyREEyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0IxMzFDOTM1LTlCRTYtNDFEQS05NTk5LTFGNzc2QkVCODAxOX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4zNjEuMTUxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9Ijc0NiIvPjwvYXBwPjwvcmVxdWVzdD44⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1464
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource taggedmi /sessionid "{A158637D-9624-4FA5-8B41-FDDA933DF2CB}"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1412
-
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:1824
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004DC1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3800
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2116
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3628 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\brave_installer-x64.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\gui586E.tmp"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3468 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\gui586E.tmp" --brave-referral-code="BRV002"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:4668 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=131.1.73.104 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff7c3ccf418,0x7ff7c3ccf424,0x7ff7c3ccf4304⤵
- Executes dropped EXE
PID:1112
-
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\gui586E.tmp" --create-shortcuts=0 --install-level=14⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1068 -
C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{E3D133CB-FBEA-46B2-9E13-14EB136742AF}\CR_1C361.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=131.1.73.104 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7c3ccf418,0x7ff7c3ccf424,0x7ff7c3ccf4305⤵
- Executes dropped EXE
PID:2376
-
-
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntBMTU4NjM3RC05NjI0LTRGQTUtOEI0MS1GRERBOTMzREYyQ0J9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7MTRGMjk3MTQtRjZENy00OTYyLUEzRTYtMkJBOEFGQUExRUM1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0FGRTZBNDYyLUM1NzQtNEI4QS1BRjQzLTRDQzYwREY0NTYzQn0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEzMS4xLjczLjEwNCIgYXA9InJlbGVhc2UiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwczovL3VwZGF0ZXMtY2RuLmJyYXZlc29mdHdhcmUuY29tL2J1aWxkL0JyYXZlLVJlbGVhc2UvcmVsZWFzZS93aW4vMTMxLjEuNzMuMTA0L3g2NC9icmF2ZV9pbnN0YWxsZXIteDY0LmV4ZSIgZG93bmxvYWRlZD0iMTMwOTI4NjU2IiB0b3RhbD0iMTMwOTI4NjU2IiBkb3dubG9hZF90aW1lX21zPSIxMTkwNyIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMjk2IiBkb3dubG9hZF90aW1lX21zPSIxMjgzMCIgZG93bmxvYWRlZD0iMTMwOTI4NjU2IiB0b3RhbD0iMTMwOTI4NjU2IiBpbnN0YWxsX3RpbWVfbXM9IjI5OTY5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1264
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateOnDemand.exe" -Embedding1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3516 -
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ondemand2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3200 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --from-installer3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1600 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=131.1.73.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff17a91d18,0x7fff17a91d24,0x7fff17a91d304⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3432
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2036,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=2032 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4376
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --start-stack-profiler --field-trial-handle=1892,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=2192 /prefetch:114⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2368,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=2588 /prefetch:134⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3448,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3460 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3464,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3608 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5076,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=4772 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3628
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4696,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=4908 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4356
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4132,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5200 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5224,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5360 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4672,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5528 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5524,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5380 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3404
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5116,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3432 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3436
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings4⤵
- Executes dropped EXE
PID:5036 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=131.1.73.104 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7f57cf418,0x7ff7f57cf424,0x7ff7f57cf4305⤵
- Executes dropped EXE
PID:3384
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=05⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:2104 -
C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=131.1.73.104 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7f57cf418,0x7ff7f57cf424,0x7ff7f57cf4306⤵
- Executes dropped EXE
PID:3092
-
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5924,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5340 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=6064,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6088 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5576,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5172 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4900
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6228,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5648 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5100
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5744,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5748 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3664
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5652,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5552 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5496,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=4920 /prefetch:144⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3960
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6036,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5932 /prefetch:144⤵
- Executes dropped EXE
PID:4776
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4736,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6068 /prefetch:144⤵
- Executes dropped EXE
PID:4604
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=3700,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=4148 /prefetch:14⤵
- Executes dropped EXE
PID:2036
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6168,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3620 /prefetch:14⤵
- Executes dropped EXE
PID:1060
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=3716,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=4076 /prefetch:14⤵
- Executes dropped EXE
PID:2484
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5604,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5512 /prefetch:144⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:664
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=5616,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5092 /prefetch:14⤵
- Executes dropped EXE
PID:1532
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=2884,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5104 /prefetch:144⤵
- Executes dropped EXE
PID:664
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6180,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5624 /prefetch:144⤵
- Executes dropped EXE
PID:5016
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4824,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6196 /prefetch:144⤵
- Executes dropped EXE
PID:5024
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5468,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5456 /prefetch:144⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:2904
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6304,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6148 /prefetch:144⤵
- Executes dropped EXE
PID:2692
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6104,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5492 /prefetch:144⤵
- Executes dropped EXE
PID:1220
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5152,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3696 /prefetch:144⤵
- Executes dropped EXE
PID:5040
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=2956,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5404 /prefetch:144⤵
- Executes dropped EXE
PID:4720
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=5176,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=2952 /prefetch:14⤵
- Executes dropped EXE
PID:4604
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=3696,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6300 /prefetch:144⤵
- Executes dropped EXE
PID:3224
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=6148,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5776 /prefetch:14⤵
- Executes dropped EXE
PID:4788
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=6648,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6664 /prefetch:14⤵PID:4972
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=6644,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5156 /prefetch:14⤵PID:3940
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=3668,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6740 /prefetch:14⤵PID:3620
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=2888,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5648 /prefetch:144⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3752
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4920,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=788 /prefetch:144⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:724
-
-
C:\Users\Admin\Desktop\systeminformer-3.2.25004-release-setup.exe"C:\Users\Admin\Desktop\systeminformer-3.2.25004-release-setup.exe"4⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:480 -
C:\Program Files\SystemInformer\SystemInformer.exe"C:\Program Files\SystemInformer\SystemInformer.exe" -channel release5⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:132 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe" /select,"C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"6⤵PID:5840
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" /select,"C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"6⤵PID:5948
-
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=5104,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7232 /prefetch:14⤵PID:3044
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations=is-enterprise-managed=no --start-stack-profiler --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=4772,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5500 /prefetch:104⤵PID:2924
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=5932,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7552 /prefetch:14⤵PID:3216
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=6252,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7340 /prefetch:14⤵PID:1192
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=4700,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5480 /prefetch:14⤵PID:3236
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7344,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7776 /prefetch:144⤵
- Suspicious use of SetWindowsHookEx
PID:1972
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7040,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6116 /prefetch:144⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:840
-
-
C:\Users\Admin\Desktop\Crawl.exe"C:\Users\Admin\Desktop\Crawl.exe"4⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
PID:3964 -
\??\c:\Windows\system32\wbem\wmic.exec:\RyTdUA\RyTd\..\..\Windows\RyTd\RyTd\..\..\system32\RyTd\RyTd\..\..\wbem\RyTd\RyTdU\..\..\wmic.exe shadowcopy delete5⤵PID:3844
-
-
\??\c:\Windows\system32\wbem\wmic.exec:\WeKbJG\WeKb\..\..\Windows\WeKb\WeKb\..\..\system32\WeKb\WeKb\..\..\wbem\WeKb\WeKbJ\..\..\wmic.exe shadowcopy delete5⤵PID:5136
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\Desktop\Crawl.exe"5⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:5192 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30006⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5248
-
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=7512,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6816 /prefetch:14⤵PID:6048
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7656,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7528 /prefetch:144⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6136
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7644,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7652 /prefetch:144⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:3052
-
-
C:\Users\Admin\Desktop\lifework.exe"C:\Users\Admin\Desktop\lifework.exe"4⤵
- System Location Discovery: System Language Discovery
PID:3800
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=7516,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7264 /prefetch:14⤵PID:5848
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5320,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7828 /prefetch:144⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5560
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=5776,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5740 /prefetch:14⤵PID:2948
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6616,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5404 /prefetch:144⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:3408
-
-
C:\Users\Admin\Desktop\setup.exe"C:\Users\Admin\Desktop\setup.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5240
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=6364,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7684 /prefetch:14⤵PID:3544
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=5700,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5448 /prefetch:14⤵PID:284
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --field-trial-handle=5800,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7384 /prefetch:14⤵PID:488
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --field-trial-handle=6568,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=3640 /prefetch:14⤵PID:5696
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=784,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6224 /prefetch:14⤵PID:1288
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5548,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6308 /prefetch:144⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1616
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=5728,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7848 /prefetch:14⤵PID:664
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7712,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=6052 /prefetch:144⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1824
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=1600,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7524 /prefetch:144⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1268
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=1596,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7740 /prefetch:144⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3628
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --field-trial-handle=7728,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7780 /prefetch:14⤵PID:6012
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4904,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5848 /prefetch:144⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2684
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5144,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=5852 /prefetch:144⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3712
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5096,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=2728 /prefetch:144⤵
- Suspicious use of SetWindowsHookEx
PID:5044
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-distillability-service --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=9018887753689036380 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --field-trial-handle=4064,i,15932024249171967837,10627774809079446797,262144 --variations-seed-version=main@a57acceeac76f9e1e94a52c2dc8e025872bf853c --mojo-platform-channel-handle=7524 /prefetch:14⤵PID:1268
-
-
C:\Users\Admin\Desktop\JJSPLOIT.V2.exe"C:\Users\Admin\Desktop\JJSPLOIT.V2.exe"4⤵PID:1228
-
-
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\elevation_service.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\131.1.73.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3292
-
C:\Users\Admin\Desktop\JJSPLOIT.V2.exe"C:\Users\Admin\Desktop\JJSPLOIT.V2.exe"1⤵
- Executes dropped EXE
PID:1220 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1184
-
-
C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5040 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:3960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bYi71pmtGKL3.bat" "3⤵PID:4392
-
C:\Windows\system32\chcp.comchcp 650014⤵PID:4020
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2876
-
-
C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:2124 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
PID:4584
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6yz9MHWb13ZD.bat" "5⤵PID:1176
-
C:\Windows\system32\chcp.comchcp 650016⤵PID:4120
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5052
-
-
C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1408 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f7⤵
- Scheduled Task/Job: Scheduled Task
PID:3616
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c0kxms7p1I7T.bat" "7⤵PID:5384
-
C:\Windows\system32\chcp.comchcp 650018⤵PID:5428
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5444
-
-
C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"8⤵
- Suspicious use of SetWindowsHookEx
PID:5784 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f9⤵
- Scheduled Task/Job: Scheduled Task
PID:5828
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\egfSWRcN9MPE.bat" "9⤵PID:5276
-
C:\Windows\system32\chcp.comchcp 6500110⤵PID:4992
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost10⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5328
-
-
C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"10⤵
- Suspicious use of SetWindowsHookEx
PID:1060 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f11⤵
- Scheduled Task/Job: Scheduled Task
PID:2240
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZzoHW03RxyKU.bat" "11⤵PID:4024
-
C:\Windows\system32\chcp.comchcp 6500112⤵PID:5288
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5768
-
-
C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"12⤵
- Suspicious use of SetWindowsHookEx
PID:3948 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f13⤵
- Scheduled Task/Job: Scheduled Task
PID:6096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Q4IAMmY6L1dO.bat" "13⤵PID:5980
-
C:\Windows\system32\chcp.comchcp 6500114⤵PID:6016
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:308
-
-
C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"14⤵
- Suspicious use of SetWindowsHookEx
PID:2340 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f15⤵
- Scheduled Task/Job: Scheduled Task
PID:3880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RR9uj9w0JM6m.bat" "15⤵PID:1608
-
C:\Windows\system32\chcp.comchcp 6500116⤵PID:1596
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2972
-
-
C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"16⤵
- Suspicious use of SetWindowsHookEx
PID:5480 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f17⤵
- Scheduled Task/Job: Scheduled Task
PID:1480
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\in3UR5rnLOQg.bat" "17⤵PID:2524
-
C:\Windows\system32\chcp.comchcp 6500118⤵PID:3056
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost18⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:6116
-
-
C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"18⤵
- Suspicious use of SetWindowsHookEx
PID:5800 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f19⤵
- Scheduled Task/Job: Scheduled Task
PID:5408
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uKaNuwIcCmuW.bat" "19⤵PID:5556
-
C:\Windows\system32\chcp.comchcp 6500120⤵PID:5136
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost20⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2248
-
-
C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"20⤵
- Suspicious use of SetWindowsHookEx
PID:1204 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f21⤵
- Scheduled Task/Job: Scheduled Task
PID:6080
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Dpu8WSTHyaGd.bat" "21⤵PID:4160
-
C:\Windows\system32\chcp.comchcp 6500122⤵PID:6016
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost22⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4584
-
-
C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"22⤵
- Suspicious use of SetWindowsHookEx
PID:5720 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f23⤵
- Scheduled Task/Job: Scheduled Task
PID:3948
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2b6Bs617S0KY.bat" "23⤵PID:6084
-
C:\Windows\system32\chcp.comchcp 6500124⤵PID:3388
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost24⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4412
-
-
C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"24⤵
- Suspicious use of SetWindowsHookEx
PID:5776 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f25⤵
- Scheduled Task/Job: Scheduled Task
PID:5292
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5GC9UgiDLEOK.bat" "25⤵PID:3640
-
C:\Windows\system32\chcp.comchcp 6500126⤵PID:5268
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost26⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4632
-
-
C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe"26⤵
- Suspicious use of SetWindowsHookEx
PID:5016 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "windows background updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows updater\windows 3543.exe" /rl HIGHEST /f27⤵
- Scheduled Task/Job: Scheduled Task
PID:5540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\Desktop\JJSPLOIT.V2.exe"C:\Users\Admin\Desktop\JJSPLOIT.V2.exe"1⤵PID:1188
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4048
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /c1⤵
- System Location Discovery: System Language Discovery
PID:5456 -
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /cr2⤵
- System Location Discovery: System Language Discovery
PID:5544
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"2⤵
- System Location Discovery: System Language Discovery
PID:5564
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"2⤵PID:5568
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource core2⤵
- System Location Discovery: System Language Discovery
PID:5596
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource scheduler1⤵
- System Location Discovery: System Language Discovery
PID:5464
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- System Location Discovery: System Language Discovery
PID:2444
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
PID:3888 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:5408
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 517F222E4D9F1A2F332DF5BE49DA9B102⤵
- System Location Discovery: System Language Discovery
PID:5580
-
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe" -deploymentID c08f7d01-8822-4b91-a823-3406ea47c35d -askForName=02⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:6036 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6100
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2516
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1789741AE1A39FD47A9464AC988B6835 E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
PID:6012
-
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:72 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " Restart-Service 'FleetDeck Agent Service' "2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2520
-
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1468 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " $s=Get-Service 'FleetDeck Agent Service' if($s.Status -eq 'Running') { $s.Stop() if ($?) { $s.WaitForStatus('Stopped') } } while('True') { Move-Item -Force 'C:\Program Files (x86)\FleetDeck Agent\20220420175353\fleetdeck_agent_svc.exe' -Destination 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -ErrorVariable err if(!$err) { break } Start-Sleep -s 1 } $s.Start() "2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:5216
-
-
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4564 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\FleetDeck Agent Service" /VE /T REG_SZ /F /D Service2⤵
- System Location Discovery: System Language Discovery
PID:5796
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Set-NetFirewallRule -Name 'FleetDeck Agent Service Command' -Program 'C:\Program Files (x86)\FleetDeck Agent\20220420175353\fleetdeck_agent.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
PID:5812
-
-
C:\Program Files (x86)\FleetDeck Agent\20220420175353\fleetdeck_agent.exe"C:\Program Files (x86)\FleetDeck Agent\20220420175353\fleetdeck_agent.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3360 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Domain))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3232
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Status))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5304
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Manufacturer))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4992
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_computersystem | select -expandproperty Model))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5556
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Get-WmiObject win32_physicalmemory | select -expandproperty Capacity | Measure-Object -Sum | select -expandproperty Sum"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3796
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty Caption))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5252
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty Version))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3920
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_bios | select -expandproperty SerialNumber))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6112
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "([WMI] '').ConvertToDateTime((Get-WmiObject win32_operatingsystem | select -expandproperty LastBootUpTime)).ToUniversalTime().ToString('o')"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6104
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "ConvertTo-Json -Compress @(Get-WmiObject win32_videocontroller | select -expandproperty Name)"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6060
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "ConvertTo-Json -Compress @(Get-WmiObject win32_processor | select -expandproperty Name)"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6040
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " (get-netadapter -InterfaceIndex ((Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected').IfIndex)).NdisMedium | Select-Object -First 1 "3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2412
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " (get-netadapter -InterfaceIndex ((Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected').IfIndex)).MacAddress "3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5048
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; [Console]::Write((Get-WmiObject win32_operatingsystem | select -expandproperty OSArchitecture))"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4584
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " function Test-PendingFileRename { [OutputType('bool')] [CmdletBinding()] param() $operations = (Get-Item 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\').GetValue('PendingFileRenameOperations') if ($null -eq $operations) { $false } else { $trueOperationsCount = $operations.Length / 2 $trueRenames = [System.Collections.Generic.Dictionary[string, string]]::new($trueOperationsCount) for ($i = 0; $i -ne $trueOperationsCount; $i++) { $operationSource = $operations[$i * 2] $operationDestination = $operations[$i * 2 + 1] if ($operationDestination.Length -eq 0) { } else { $trueRenames[$operationSource] = $operationDestination } } $trueRenames.Count -gt 0 } } if (Get-ChildItem \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending\" -EA Ignore) { return 1 } if (Get-Item \"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired\" -EA Ignore) { return 1 } if (Test-PendingFileRename) { return 1 } try { $util = [wmiclass]\"\\.\root\ccm\clientsdk:CCM_ClientUtilities\" $status = $util.DetermineIfRebootPending() if(($status -ne $null) -and $status.RebootPending){ return 1 } }catch{} return 0 "3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3500
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5220 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\windows updater\Decryptfiles.txt2⤵PID:864
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1696
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Decryptfiles.txt1⤵
- Opens file in notepad (likely ransom note)
PID:5708
-
C:\Users\Admin\Desktop\lifework.exe"C:\Users\Admin\Desktop\lifework.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3784
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Decryptfiles.txt1⤵
- Opens file in notepad (likely ransom note)
PID:1460
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2692
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
4Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
7Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
219KB
MD5589c2ad695fde2765b3b817c0c32ddde
SHA1222f05891bf62ebe57f9c3884524052831fd4854
SHA256d9474ef1db4a39895e9fef2a185cfb10f6328f90fb71c10a2811340c6c7bcfa7
SHA5125f92db70726e82e8d277b40cfdfc7fbd3ac5eb3a288e40e074f789d60a5d4edc65e4a7cc8f76211db5c5b8aaa397191d14ba4bf4a1374701ed0a1586c04e76ad
-
Filesize
4.3MB
MD594483ea960f9bee9044e0a8ca31fc33c
SHA139e29cde48af84b3efdf16ffeacdc35be3e0e1e5
SHA256e308f70103afbfac265121f89759906299213e88fb9802352695f8260bd3d31c
SHA512d189adf07c6715d38547bd8873234d16596970d671ba3fb9c222d6a9aa10a5fc7cdcc6cea6627c5b0031b93e60e6db18e45b2661532873f510151a9b3f1fcb94
-
Filesize
3.3MB
MD5ad845b34379404be8224d2ac570d4f6f
SHA1e197c7423c97cd802d67f944429e83a5bae3dac3
SHA2560c44bc05baec15de76da5074dd96fe19c81f3aa82da628c57555addc77bb0fa8
SHA512abc8d3b9fb90384cf4f2ff73d989227add3aa4f9686a9f7c243f2e52983349bdb92f7b700cbe5f7c27c1867b7aebd1c61f62008145087e47eee58cf2b9aebdc4
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\7a012be2-2bbf-4145-b637-1837f8aadb49.tmp
Filesize51KB
MD5128f1298bd370339c033d8aba64d54d1
SHA151d420c541de842a64daff936f1fa0a28630a944
SHA25673a2bb0d4abfc9216bcec82388a66de71ffe183f670354e9c924b3c21a1fc4df
SHA512cbc60a795be8638e77554a406a169efc5445df9d25a54999422e00ccdee666c1678ace3542c5dac8e19fcd0dd33b8453a8e7f40e53c84dc32562e66eed306489
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\CertificateRevocation\9462\crl-set
Filesize626KB
MD54cccfca2d549f6bf9e421bb367025d43
SHA163113e18dd6320880b6baaac408ebeba1846b1ee
SHA256a729eccd37e7e2c24a53b900b6c6b1db34958cb931024d26b63f886c321e27d9
SHA512afccc3e734603efad0b527b2160445f4f4d5160a284b895fcaf8f41afc2524a6da56686a1f9745e0703b4283def6343adde33c750bb5643968b7e32826288a53
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crowd Deny\2024.12.19.1218\Preload Data
Filesize16KB
MD53c97222c910c2aa1fab0c39a1c8d2b11
SHA1c794a8758b4fa74c7aa9536effe9bfa774822e7a
SHA256c7b91efdd09d75b47036e241eb55a238065ace2c26cd8f31328e8a9f4b4102b4
SHA5123220065c655bf174c466d9ac03d3040e419f30d081983c23a757d2c0c5e4720aed2c71e88befc0d8b6987d6abd6a25289731d7f4fc9ed6348a1d762f67032153
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\3b0a18f4-015b-42ac-ba7e-9bf1d163f2b8.tmp
Filesize165KB
MD5dceb0cfa9b61effc8788488f43747572
SHA1c43235ebfd21469a747e8a264b67f874e0400cb9
SHA2564f6f8abe6e2a6bbfea1c79b495019e80015343160d7fd99ecd0d428c9a8fd57a
SHA512a4f5775c654fa4f31f53cb6fbab084939bd929feb95740b904045cd1f0a52c819e90876e56e66f7d1bb38db66fa0cb49c7365511f8346eec3cdc610e32b02c6b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\BraveWallet\Brave Wallet Storage\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000002
Filesize23KB
MD5f837d382a885a07c34a3d4bf4f49373d
SHA168ddceef1d164a48d9d01d4a74f26b7897323229
SHA256dd05e326cf8eac3b55acecf29c842ed73e6e6dd06491cf47f7e8800680ab3e33
SHA512ef010d89971c4f69af7bf541430364c56245a5b63ed730fe628e49f48fa9e201c7f42b1e104eb14c3193bf79dd7ce20244f6b963e9996eb8308c0d61f444ece6
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000003
Filesize23KB
MD575fb76ec35595f04717e8b3f1dc3ae2a
SHA191770c8b9979c8245519e9c5078ca10a47524169
SHA25662553d159189834af73c9a6264704be5b2bee9a08da66a14768d8e5c6ffd2cdb
SHA5124f05ec0c9a34ecacb19bd13aec6a15794951bd42b005986967b2d8b347cdce22fe8edb0b7d24d3e470416deb01fa69c0bf0fa5ae07eda3cefc26b0073dc9b62a
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000004
Filesize18KB
MD535792e91f123eadc87b14296d581f180
SHA1f283c2e274c1d35c37da9039bd8f6d33ab6f59fb
SHA256b8a10ebaaf8455b1b99b52e47691977409de4a2fcff998986a4800107dffd9d7
SHA512f172630d4767fa0f34afd173c159726eb692d8d91bc8a50a66d05d8e033502f4ccb2efe77a8160f036e6ade16f5bd49a23be7f768d30c528ecfb60a9d282965c
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000005
Filesize22KB
MD52949c26c74d6758b0b24f8a087e85c74
SHA1f4cc6e8482666d0efd96c4ac1b6f7b349437a226
SHA256f87def0570c79571382758bbbed81d3c35c3417c0ee61854328e1e9f6aa2c761
SHA5128c1866d924767a78590406be1757dc8a54115575015b3dd07f958493fb97aaddefb9082927f65d53ca28edc9960a6fdb05bcfc98a909aaaa016698c29d0a7b34
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000006
Filesize30KB
MD570cce0c43ef9e0847c85a44aadd7633c
SHA1189ad874a1cf3ebac80a44f7abd3e73b299f0956
SHA2565f17b5408d534184584987c8ff8739e36ad842967808797a3e2a8a94f21b47e9
SHA5125528cd156aa970f17492438fd08056d4c12c3f2378c3bcc322f3a74343ea8e17428a0b1f720d6309667b959ba19621fc7a4d1c5ef4a8264bace934329e8dbaf6
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000007
Filesize20KB
MD5384eee9b1824c7b379821d39bb576312
SHA140c5913ca8f24b69815274b63c7997427face95b
SHA256fd5cd1725025f64c168ee10c9abd38061debb4d8b89e6ea2562e61d8f337e07a
SHA512032be9942a2cda49a73c0e7ed25b2cbcb25457669a18c32429587c5539c0c81bfb8ac49fb83c7d71bb9652eb230dfacc13e4e55c8934e5a780cc9e1d2d56ac51
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000008
Filesize51KB
MD59e928f6729f8c22031b806b09764bc92
SHA160ab632564ed0c5326a2af4a1e8bc264fa74b364
SHA256fbd213e02e7447d8cd862822dec1678944662030ea2297450affc4896de36186
SHA512a48d9037ccb14a1e7f5b9fd296313871a228b9448132a3e6b0037e4b996396bc09395ee62129bbf2c85ee703a648c6e48ff23c98283fc0b622b23b301dc002e7
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\f_000009
Filesize16KB
MD58644afbdd38d39b25563719b4361e2be
SHA17db803e3047a7fe376f292b709441d7a3c61252a
SHA256f81e5823e71ad1b84befd090f8e5da2c6e3d3bc1f326b39cf58328fc6bda561b
SHA512cc41c4026662a4a66e3fed27880d2f3769b19b71cb30814cf45b95994bcd938984d6b7876b8f688dac592741c5fe19fdb42bbd3c09f25bac4458d49bfd0421f1
-
Filesize
160KB
MD5e9fcb41b1fee21cd572a91184c8c23b8
SHA1699099abc30e0d96c364a68f967bd2e26a1535b7
SHA25668590788b1ba533d2f2ca85f81dc711238a37a095722823f5651177b38fc2b61
SHA51230393a706900f3ab4f16ff326a7a9da68863ee254c2c9bb5d8bcfc95239f919b8bb3c392c064c1bfb86c23344769ded300f2c11284ecf89ee8a09d5284f968cd
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD595b314534b86e6741fa86a5357080431
SHA1a079a66bae8b16675022a9329f05df2fda460207
SHA2568dd3b72d2fee2029a10df34cf1de5242705869552c5b1d5ebaa05ff20fc54c28
SHA51202441946bb32c6d1094868479df936a0e6c6e0fe55421ecd650b9686424a574b9ba0444514c6b050b8fe698b941dcb13d348766ab6fcf3f1c751df8c1ddb8ae5
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD59cc64b0b81c291c75e741e97f10c2a47
SHA19220cfb8912ffb882868ad47f92395d61deffcbb
SHA256d9c70ac61395a2c241439c76ec209e9d96f3ce7e9031aee05de3ba03ae473b0b
SHA5125d0518ec9d04c32a39a75a08346b369d91465c8ec6d3f352b817dcf66ff3b4b4797ce2135ead9a5efdca3e4a5a034662b21a4e1d58d4498973f4c11d961d810b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD53ce239ce3159f405db8d3e1b21a4b6b2
SHA16dc36c002a8ffd00d1295ebb36e8dc00f7d9ad24
SHA2567889720436d7f9d8dd7d238fec75611071fec413c069eefcccb140f1b0b5370b
SHA512b87c2493993e61e78d712627880565e8a591d64fa2ba7a4b5bef8ecff2d1d2cced8c315382b8290022c53f83c59a0474c031ad21920e2173fb1a81c41362bb51
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD5dbb22715582ee3e2766ca3ad1b1ab5f4
SHA17a73253da08732c631a9a0e988e660c8f036ca2d
SHA256e59e83a5dbf639a7594fc98bc1abdb441714087d79843f4f6ce26845de6175ff
SHA5125963aa9c46bd5bde2d0d55a2c9541a7feb55a4e6f4938983f9b6cd55f419378183b41bbd0b208db0dd9f97cac346a1eaba59e37e459f2ee542c15910d4fee9c1
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize48B
MD5b4ba54c218cf91a4b2996c1f19b189d6
SHA1ee1951ac32f458b5071bdb81d83a64e08863587f
SHA256720093a30eb05baf985249f9fc7c0e799e5535dd19f06090918d1e2c00e9998e
SHA5124c88a5e211a78f344fd17f5560174e7aa7bbcfb0421308d7b2032a482e8349a0bbe0de009b3275333cd5da4b5005ffcbd6de3fff0eb8037305e3af913b7fe13a
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD5384bc083e173ce14cace852af8c3213d
SHA1ee3153e3f106595b9a6951475838a1ae94bc9ca7
SHA256614e40f4310e5e23e0e99d316cdaa10ec78c2b30e21483d001356918020f8fdc
SHA51279dff9c6fd3074950d5010d95d1d2be41738bf980d36c23ccc1948236d674a26bf92c8db27e90344b9a440addcbfeac667e1bd6b22a7f75619e98a12541bd89d
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD5f4967d1e4a52ca670bd5b3ec1949c546
SHA1fb309c650c235ace547e9fea0f7069f082da99a0
SHA256c31dc3cdc0de2670c138e08310bdb237903100de130b973462273929ae82504e
SHA51274d290111b5913b530ea0e5170dbf52d65d3a3ee39d0f62cdac5cee289d5f3f70373aeee047c01fd5bb4215d20b6d4bb76901c202238a9595709b3bb4a6e3b68
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5897ec5a6fe9edb2c0037983cc014320e
SHA19d758dafcf8f6fce98ad268af56af79ebc58eaca
SHA256e6fa5ed8769228b208081f414ed12431fad8d74d302b2a8cca1453801354110c
SHA5127cfb42f4670868070edf345467721a65b300ff808f7956964cda6a0fb19dbe8dc5f2e41169fa8f2292e75e63ad6699855ebdc0d800995efa3ce5125898e31040
-
Filesize
1KB
MD57b1365a92e3ef21a704853c5186eb592
SHA129188cf5204cf812203c2f78635ae36f6f7b6f3c
SHA25604b7a2af96600658d40e790c8ab6052c9aa8c25eaed61814f8793439d84f84a5
SHA512a0355e179c3087ccf768e5a0d402f22c93e2504da1080d3f1e61408a5cf10ffec1c32a53f416889b1a89ed41b3adb942336e6de904af018c478f2f791bc0bcbe
-
Filesize
7KB
MD5293ba0b626a4e0e5f29669eaa9be815c
SHA15daef86c4d1c0e4404f21e243f21bcf19fad7f5c
SHA2563fc11c76acde34e919feae2c7a300e3342fd5178e840499878689be475d71490
SHA512d241e7fd5806a5841631b6bbe0270ce16de4b30b28fa79a7d9c905057b255ddfb7b66e4ac5e66925ea35bc12f8a0b6fdb1209f6700adbbff66cd573da9d7fbc4
-
Filesize
1KB
MD5236871dff13e87d1dc2e13786517f15c
SHA15051c63a24f9c21f0296583208c48ed087f549f6
SHA2560b3edc94001565768c699cb5b942665a329ae1be6b8c9b18c1ce6a73b8314148
SHA512b310508a1b24e24ae5e179ba76c904dc7be73ff95990eb16fd833588e6ac0709bdae21ea01677d8c42da25f1f725659f806f55839f0228d77f94d1ce7339bcc7
-
Filesize
1KB
MD5c4ff8b4fe245de28c94054a28f3480f9
SHA1483f8d51a6d1473ce7682608bd91af82ac133d22
SHA256b95211782226daf9241036c142b17eac778a1e6bc2c33f98efff440ce3b095f2
SHA51216b984678eb9bd01c8a8b076df0b332711f0b90aeb485b3f60f4ebc8dadc43e04d8c59099dbbcf31f2432ceab0838a0fa87dca8039e1fd7ef01db93271c65fd6
-
Filesize
1KB
MD588f285fd26ec9726bf47a6c519502945
SHA173c58be74e509551ec368db9c713348928fd46dc
SHA256033ad9b6f226c970f96845fc0ec73e6f0957d94e10b809ce4e138428a95e43fc
SHA5120e68c8b56ee86b6b78225d76ceed9c555b2bf0ae417299693a2c277b0659eee2b8e18ec0fe63f3fe45fca05fbb9b49e8e77376f12d9ebafdb498809ceecdf00b
-
Filesize
6KB
MD5231651704088f98e1df57622c699cc7c
SHA144d42e942befab28f5bcf0163500f3c47185ef74
SHA256dd7b62c58711c1f60f3f3bce07ec28fcd45f032d8348251deae55035a6093520
SHA512ded33bcdb371acba8f58a0ef72d69e7532eadc0519340b80125bd99d65837582a6209a6744dcf0ce21c25f6fe7185fee06587d263fa61024bc7387ef80d88924
-
Filesize
7KB
MD59a6d939c2ec12c4bac67a7abaafb8fd9
SHA1dec5fa0be3142b2c6be61bf7de159d52da5bf9d0
SHA256ddf6d635eac4ca01c58a21e1b6cd14269ef0cc338693231c09e85a9f58b1e4fe
SHA5129964a12918871b9ed41302d0c0b6118e53fd2ba7fc554456aca20af862ae912939bbd35f9746e2a20eb1fac3fc0391a041ff92268603ce126f95bd4d705d2ee9
-
Filesize
6KB
MD582839b6a95a7ff768be54f353fba39a5
SHA1e1568b2687223eda188c9f12d4cab9d5656c9ad5
SHA256f95ea2235576f676804fe93d26d106d564c1bfd3b2bdea39bb8aa1c1f30fc5e8
SHA5126f1b2e028eebc76bfbd6e33960a7d4ffe53ba151105c6ed6f31b3b8ddff0670cca82eeff819c42dfaa7b35d76b63f62136c787952a0cc45786ec22f5a83d3267
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\DownloadMetadata~RFe5a546b.TMP
Filesize590B
MD527a7002f2037d59967af75f2d24fd751
SHA127e65d85c6af3eeb8887a79872950e866c3f97f7
SHA256748f11ea0375d079140bdf2d74193123c677322693877a319a53bdc537102755
SHA5129a243239b4d275c612d418f0f580595c69826441772cfd1d3b2b70a7e3de249237e4265d51f9748f5914bcb25291487ebd628428f7a58c53724b4cfec689c873
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State
Filesize3KB
MD5157bfe9acfa5c972b5b252183990d120
SHA13b5f6aeda07df6790b30f24e2f99433c954543fb
SHA256cf97073179217d5b942c1e01ae923ab6fb4dff8dc18a3be9c095c60eb628b750
SHA512f17af118238d26209d4a12901cb4fe624340db1853ca5ae46863a00f11c340e29fd5d66f0a27f9f3adeb9c9db3c78d194cb353b5aa3c1c2416cdc46ff98a2958
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State
Filesize6KB
MD5c85f4f78c33e3cc76d3df025a2020945
SHA1b5b4581e03e5f9c6a5eb85a905ed00eeb02d06ea
SHA256b15b9261fbf307038efa76293d8871942c5ea6576f37eeb3c99e3b138b46486d
SHA5126f8ff5c1b4fef7c918629593b49255334e8944b339c1a41f6fe6ac26b8610a27bc80c5bfee125008625b93c4601e311b085e9e057abd865f2e3e7607865bac6c
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State
Filesize1KB
MD5ffd2c83ed86ff683a689141ae0dd1dd4
SHA16655a08db2b83b5c591d41809389711e38cb011e
SHA2562c371bbaef959753a406a57ea7db9412e6bc9a510521a4ad62e5de24187a6774
SHA5128f64ed2a72d3e384dd42f5e24fd3968a6bb0916c0156a2864b84112dd246c655cc75e7044e9f5f3b2e3380b1ea62befc4ddd361ca261353dd1cefe3b7920889c
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State
Filesize3KB
MD50576d2fb0bd09cb88f4bb0fc5034d4ae
SHA17408092773e9f989bb04b9d13cfeba7afc7604da
SHA25615a20f7a547a968bb0672799adfcb350bdc2393cfcec7c6e2f25c84ff839bce6
SHA512e02feb2694539e5a153baab32819af96ed7772476fa6af6d2ddb0e50f1f58bbd1e0aaa91daab77f9bc9e84153f9b67562cd98e1002b05c0af6886310954871e1
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\Network Persistent State~RFe59f449.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize2KB
MD5fefdfb70b192f734cfe206d2f8e1d9da
SHA15f0b83dede2f869d52c658c90057a8164b23a7d5
SHA256f450419233ae8eda28d08f9e48d3d374fddc9577fcc20b3e64efc3f4c38eedf3
SHA51290d97db138d3802ae347b73bdd2638d7b84a7f1944124716b18882d27308f1194a6270901b131d50e1d8de5aedcf97e83e983c014540a3c2ef2eac49c7a40038
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize1KB
MD5dab289ed21eec76fce05f358d690b1e3
SHA1e376582a5c632077c04b2c6bd7b235c85c1ecc8b
SHA256aa5c1ccb166553de6894f34de84bcbb7599facbfeb621ab7004189b0a1ab725b
SHA51288a0d79fed6d4e1c3753362fddf0a54ef06ab3825bbb9cd7775016001beeaf93e86fbc2a4790650f1e316244129ad51579aa65b10d0ad88aa81324c44c08b422
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize1KB
MD51b7a8dfff213390f7d0ae1e99df86473
SHA18b1090e94737caa36cce3c1311415e1ceab2c041
SHA2565400d0656edecd4c40f8c9396fb3e31aa3f478ac03babaf0786a9fa261e889d3
SHA512e3438757ba452eb141e1ef6aafc1e8de7f0fe263748affd9728d3e32d10b30cc3735b62d10da519fc67a5399dbd22ea0cdfc0fc37ff4c4cb32e12c3ca7a660de
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize522B
MD5770c3564df8b77faabf7b77136522636
SHA13f70dd60b6bfae310186372d29ecc9790acc4a54
SHA2564d8ded0d1d28bfc3d6ba63740eda1d79ac5204ee09a892ce43949bebd7a11991
SHA512dae9f6d275e7855e0dae594896b943837916f34115b918b7080d0f2de680b7fc678a973650af2eb5deb3ce09b2a3462a3203b1fb56a55d980eb8f0fb99b4c03c
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize1KB
MD59f2820af48762b0cf553e5e819e0750b
SHA1e363dc7820431d7b96419b09901a58de79a6421b
SHA256803ab457e01f69a6f6401658c70f80d9145880a85dabd474c518a02616664934
SHA51297818d6b69396f221548d599055cb4007f4cb23acc0a57b17b9412a40b53f1232b9eb82b96080affa13e56c7b5152bc18a3f17de6dd1e843c1fc4dd24da19b60
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize2KB
MD58bcf93e559c3ebd10654505d9107d17a
SHA1f66d6b67d47a694500f4a8b08fde653072fb821f
SHA256cdb05cde0c0dddf50f567ca3745db33c0f40d173a67460c1f07062a6b57c3ef8
SHA512952624ba93aa4da95b89f3bb1b8b1f999a2926e9c7a4c6c199c5ed07ee73eab15116c1d41a1c4d44e1b5e7bba084b0e7896beb32f2cc3165b5757e82043ce9af
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize1KB
MD56a9a35de7dc56a627ec8fba0a28546f0
SHA1874bf9371b716446b31d416e6fe0a9271b3b85cc
SHA256a2ff6c3826a4ca79023ede8d26c4a01a1f270ee39699f2afad02079634c81e38
SHA512300530a49161293a1462ebe9a0846625a3b89bdbb106bf83122edbce5567d6f760c3899f0fe20a4123d6fb8569f6cb1bf7158190b8df89297a84f56bb93bfa97
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize857B
MD5fe7d61fe0ec83832e80dd4acc51882fa
SHA1c2280114fc964316b7c1a00d8cb1279e13106cb0
SHA25682e2434d4d4fa833649bcea06c22aa0e3b405f531aa79645b3c7d4c704703972
SHA5123081f6a7399a580863340117e4911c3531d491f92b71659b9ecda69ad8f6359b67fb5d970f363ef158d55351b0166c25fb463e136d8d0132f32b0e73a56be6c2
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize1KB
MD578271425e9e43b53fb43f6385f83fddd
SHA1fa1e9b71205a4905b5ca3eb4930427057453fcaf
SHA25611614bace088a6cc7905264dfc9960775e4781e97119e1e0a2392d1c7c28a073
SHA5122b8c94227f5dfa5b749a67d0eb0a851312e7438dad2f5751cfddc0af1de4813ed9479d8cffc0a6bf545690b6dc5069097c5fa5bfad07674050b8fadd32aa3c47
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity
Filesize1KB
MD52a9133baafd525d0b7a25baaf85d14c1
SHA10c7506b429c87eb2e5bc536f8d83749630873eaa
SHA25604b9b689a1a54711d6b00d7cfd9b906f41ea64bf73b5c95dc639d307aeceae03
SHA512d95fedd6aeea3eade5924fe84fa044ef2266924ea292cb9d22730d5c09a97c24fa79a24895cb74752c610ef935f43dbfba11748f92fd7c531153099bd37d2b42
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Network\TransportSecurity~RFe594c70.TMP
Filesize522B
MD51e35a4cc18472c9b7832aef23d6b0ee4
SHA169c14ce0cd332c16d540c3f21a0690ab0f6f8d8d
SHA2568cd044daa4d1e21782ec5e1bf9cbdca52581b6202b74fbbba069da36baf42ea1
SHA512ae8c902cd7e50906a5de8298c21173047ec850143fba261f2fe499fb29392aafad56fbed85f4c124f15926d835289f1665b6b6c17049a0c10badb28854d9b0c0
-
Filesize
21KB
MD565ffae23b715e8d4a38736df6034d953
SHA184d509e501dc3a4984632f99d7a7b44aadfb9509
SHA25690f81b3c216b2210383f849161c53e5f4f71438d5b7cc068bd801aa5395ba2c4
SHA512e04b27e45389f36eb8865d94903fd19cc58bf56e926c6f4b5619f7ebc70794816070faed19d1f14c436cccb41c72bb625022b96512d789221d88c1347452014f
-
Filesize
17KB
MD5b11591aba0133935942c102c42f7e8ea
SHA15d6a361a71debbb298396374b227c5b038afaf7e
SHA256d40504882c18c23775015cb5da863c853af66fcbf5bc2a55c8da9582577df13a
SHA512ace217adec9deaea6b793a6c9664d2a56e364b111a527f3714c2af94af43f46d047a2aae94323856c947c6d6523ddebfb97ab8f417432336022f1bf218171e67
-
Filesize
17KB
MD505263a06ff3a27ed04b2161e28d2b3f1
SHA1b3d05f7db2eff9e8ac2c45a8dade14a63f77262d
SHA256c6e7109d3c60f7a1da9bdca884a3678b468ec47d28574205a1999082d93cfeb5
SHA512fa8ee29b55662d34531e8249fc6038a19fd6ff14df7941b27127e167433148df7b041744c0217c879353b0ba9df3ea19504af95f8d8dd4ca9cefc9a5a0199ccf
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Preferences~RFe58f97e.TMP
Filesize2KB
MD5569d4458cc420661ea0e2b021e705c9e
SHA170798ad4e4aa3dc83ce3c8c5b3f69cdb2bfb4916
SHA256d94ca26a1c4dd84d4883e532ffee9ecd9eb9385fff5285623d53a7b07afda49a
SHA51298741319592a6b09ce1844fae58fd3b6e7abb755b71acf073fa4d994f38360a903e49294e31ca03f3ff4edd22a84825bf5bca334012986da9efa1f34b99f7138
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Shared Dictionary\cache\index
Filesize24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\FileTypePolicies\67\download_file_types.pb
Filesize7KB
MD5d28b6246cba1d78930d98b7b943d4fc0
SHA14936ebc7dbe0c2875046cac3a4dcaa35a7434740
SHA256239557f40c6f3a18673d220534b1a34289021142dc9ba0d438a3a678333a0ec6
SHA512b8dbebe85e6d720c36dbdae9395fb633fb7028fecc5292498ac89276ae87bd6de36288fbf858f3476e18033a430f503acf6280596449dd0478b6ab7139f3cea6
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
77KB
MD5fa0ff8f117069cb14346590867fd2896
SHA174b9c9f79c8f0b515a77513758e8513f3f9db609
SHA256c91430aec0e35ecd71f21da25eba3e978018e96d92316e82ffdb0234ad5de939
SHA512743ed77d4f0128416f8a8ae06797c45708daa45a02363292d8966ccb4ab15c2ea2fe3362400c78e6b5e36b98e1afad0d10af6d07f59e14e0136c6d02e56b2cd0
-
Filesize
60KB
MD5ca6c98618ca0a7349652c780b713f2f0
SHA18bd69cc6fdeab6ebd23e6013d479532652e7100b
SHA256f0f265f66b729e38d5d5d616d61d989c518fcf231a2b5972e86b048c860f08c7
SHA5121fe8af9ca4a84a5fd99dd2943e0ec1f78f6c47fe1b3519a0e8f056c7c52eb2bc9cabd6755a89f075f601c97bcb8a3facfcb75d98e12d6ee4df385e8f3c2d0392
-
Filesize
64KB
MD569af8de76fbd8f61ce5a10b014079f8d
SHA16e4179f5e40825f750c1da996d2a041846feed33
SHA2560ea786dabd95c0bb002b58e0c241c241a8367b4591437c12c51601dddde15f5b
SHA5123390ae61045fe06a16d61a0f7ac62888d508546eb5a82aac8db2b4a1cb41a8878cb343914393df7a84d6a07ac18d940fe4aaae0da9f6ac99e088d1954aa6c3eb
-
Filesize
67KB
MD541fad890c27e3695d65b4a1620567581
SHA15ec25da616bd93de2fec9d535920501f91b86d50
SHA256569ee41217cf5d6b2c6d4fcfc2c0a66135eda2b2120840caa9b3d781d7aaf2b3
SHA512ede202a643c44444da290b3531d60feef6d337cdcf197f882db2ea1fe9428cda08ff34ce1611c8dcc9cd5598f2a1eafbd7cc15b12b732a132564cc7c6d9f612d
-
Filesize
68KB
MD5802437d7a12f2f51f064356c3cf88b4e
SHA10127f8046a8287a3e3c841afd2bce595077cd036
SHA2561c3de4b4c51fbac8eb5e36531f0c6f1f0c0fa636786b293e2759ba5608105e96
SHA51283a33f44e270bd12f8fc7c95582d0482e43c86fba60690c1d7bdad431445b48d26c6316ea8627ea0ebd480eb2a75a3be789f5b907a5f3f6f9b3b8670d4757f46
-
Filesize
71KB
MD5cc01e560dcd063f2efccda254a7eeb55
SHA163c4561e7dca57e4c94f1798d3d00833913809c5
SHA2567d23d1d42449f68a5e07ea92865699c4e71fde7c28d428c81afdf133fd6913a4
SHA5124bac80ac12902e393970396a0ec36dab48193814961499ad7e0ec1c3813a5107bfd0d6b8b2dabf0c907b502938d869697c5744bc3207a71dfaf6855b8b75c5d3
-
Filesize
71KB
MD5aea5ae4292d3fe61d5f32946cf32369a
SHA1b2fdfbea5d40d991c4b3dc334136db4f8fc8a282
SHA256f800161200b766e3b94be48b6598eb5995c11791afddbf18f37922834d21ccb7
SHA5124c8490bcb2455e0bbacf4d647be89baf8f4c1f7106872e917901025ab8ef5df5a0c8437e00c88176cdc9f58c965c3208f1ddcf4e9bec4d7de1a73e52e243f241
-
Filesize
74KB
MD510a66a76cbfa8c09421319f44c9fb402
SHA12cb0637b891f692a5c0a3a2673d42d180cc5b65f
SHA2564200ed05010c87bad10c8168bc08946139ffbf2c636793b9ddc63165d27bbc39
SHA512e0fffabb2648270f58e02cab59689a00714ae70aed90eeb16b2ca6eaaeeb628e60e62734d3dd5777755f81c899bb2ff62c11fe63bce190de893381acdf35369a
-
Filesize
75KB
MD5a8de1772e077238042b2e09598bb71e5
SHA177094400af4229cefafe4dad585b01031c9ea0ec
SHA256642d4804e6c23f399d6c5918f4d69154db97b32db31490b207587a6c25584e33
SHA512b785de803455abecd66cfabfc39a1cbedc3fd4ac3a64b9ef96852684259032d81ca330621ab548543f2755b45d49e784c24b624637df3abe93e2ded005398a99
-
Filesize
70KB
MD578a48f1d85032e408bfb13139c53b3a7
SHA1ee89aceda3a39dfae3870045a8b40b906f119186
SHA2562ce1b9ad657913b3b1344bc40f897bf108340ed2bee04ecc65802c8feff95529
SHA512df4e631adba4cfb19c9aa21ee24aceefc9df2023f1c8123e3cdb43020cf8af240b7078cee385c43d1db25bf81a894922ca166fdd8fd239e630126bf24206c77c
-
Filesize
74KB
MD52b39df71304989727e194daae1ae33ed
SHA185709467c236f42770f232fd56eee45dabd9aa73
SHA256a97c30593a8cded9b73d65b809da1e6dbd1efe323c9407f92f88e4aa5f098437
SHA5127cd9617c5689f99e58f0c1fa3c797ebcab77d50b6072ed1e843d0920b1a7ccad55ed3045bc77c3a93646ab4765822939016dc13822f7936ca8a32920b634ddd8
-
Filesize
51KB
MD5fd72407952b145991797823f0a9fd670
SHA10f6552ca2691b15acf45c103e27ea09c06690ca0
SHA2568588ce16a6c2eb1309cdd8d4b3037cc56ee9d97915483939b66e579dd06270af
SHA512f9ab7e4a1f0a41bde56511d4cc818f5e163d35d17328f46280efea08bcb2e7e02125fb114827b0f914285effbefe0f45dff7b7b1bade126ac516c17f16db11ab
-
Filesize
54KB
MD59d7265ab8cb0d4cd9d94cc8acfcd9616
SHA12881ba8c35ab5d57b4ad6046a46d873488f9fb74
SHA2560a138ed63fa89fb7255953ec89a96cbf426757949dd3c045e389cf24cf90182c
SHA5128ec1460d45ff112c85f1c7e4c1d2f0a95dd3b8cc53fd2213191aaab593e9ecad2d4b5c53341c9a5573e1ea7dbccf9a9beeaa28fecfe5a0175e84262409212fd7
-
Filesize
60KB
MD56ed634427d3751a5807b081fa3c78409
SHA136c68dd7bfa373f97c9552e1e1a7e19744285bb0
SHA256432eb3eaf4e5d67a02fdaa7bf9054ddf59d47101d4b9b04a70a5c66fc8455928
SHA5121f71ef0a0b19819ee118a5bce0f5866aca6490276bd2de1598fc4bf57f9a503706997dd3fee8d2d793ab5e17adae852a4c2fb97a24ae92262f6e3d049ae20de8
-
Filesize
57KB
MD5dc24aa143631d42d1b4ca326ccbd80c2
SHA1a92716f28556efd8b77d7c5e62d5e97a3c1ad4db
SHA25688327a637cea34d47f673a9d54d5b70e31b86c0d1b32bad3d7deb7500c6b796f
SHA512e8922d195e6bbd3fe45918e61fc15adce0b6d4b133229f5e9749c3f89dfaad8e5e16d30c1f7a5cd93ab0ccd58ac1a4ade00fa95b92b1ef44d0a307893ea707d1
-
Filesize
61KB
MD50cdc363d0424f6edcaa1ee5fb54c72d5
SHA176423c51163645022dbfcd9f7fe985f3485d398c
SHA256639c8808c6321904c622c362d2d321d8a8ecf25e80af53e2e0f57b79f6d81cf6
SHA51222381a6ed1b646a4b9fe80a425c05a47bcdc808b1fa1df0815b7c60e5040115e5292ed82e4277d19f18f2d9373bc7731ac51f74a76e53c1701a7e02bd752abc6
-
Filesize
75KB
MD5aba9a1d52ee21a2a4f22ff8c09e81c91
SHA13027add1920e1c3f4947d30c1202a005283c4af4
SHA25667d7d59fdb6bfb4f9b07e1a8e01da535921ad347a9851b87394643ddf047e180
SHA512b1501f3116b41984538dad92136cf1b9faed063b3a51c80a43741a824caf2f28db9a082eb089d6cd4812e4dedf9231f1a5d41917a958b1684382bc9e0e583a7f
-
Filesize
6KB
MD576b7ca2a0e712e5abf519bd8380b1f49
SHA1fc49391c23e30eed55bb3893da2b423929b7b47c
SHA256b759c588571e20c3c7e6f54c8a1923719ac36eb81357a4fe4f6bfe85aa4e1acf
SHA51207ac7e90b1a8bffb66c8ce4ef7c078d5e759bea93e0c4438b3248cb71674eecf1f620fae87ae3ce1755b8a4fff7d09fc82df0c3e5947ad0223bd162c6ea4d377
-
Filesize
51KB
MD59f01a61a1fb4dae3ee98c3142b9ad335
SHA193a20dc637541a59fe5e4e04a3288cd5de7b8176
SHA2567cd544d045dced9f29f41bcf9225622a42e2537281fff1873acfd782153bb629
SHA512f783ff3e0f7cd85ed75fe3897e5b4439e08ab841674e4ba50de3ebfbfca847e80494e921da0570803fc144fb7c047087cfe8409b373443e63caaa3b236a88961
-
Filesize
51KB
MD5b39bc9f3ed5576155ed8e25bc7692496
SHA148961be5f9cdb2891ba02621e17a4a1a3fab0e80
SHA256e00cfb599e06a117224b32164621b486c64666cf11bcbd33ac6b5d8346abbd18
SHA512afd2782968ad279c2cdb0802534e1d2fb83f2e49a2e97953c83655d17d7e9afbdff1dd1ea66c70d3418361bf06d6af8a7f06ce5298909f10dd13feb18a41d20a
-
Filesize
54KB
MD574479290e80c9b2b32b64b592a9c60b7
SHA1ede6732898af208d627f800063b10ae1bae46cda
SHA2567af37d3b845ee39f2ca0e314b9b324e675e772eb94afb9e2684b40d0369ca504
SHA51205e0ab0864d638b36be5fe7b95ed0e6cbcbdc1a63657c04b95f4e42c22246c550535971f45cbf151c71e4c097591b845893b8acddf629e5933b695bc3a68b0db
-
Filesize
57KB
MD5520032bb904cabb05a409d17170ccd65
SHA1cc084a02e320dc49a09f03f34b623f747ee40b8e
SHA25664523dd8860d6d57e824f810d8738ca5ecb6463e7e5c79289807aa65d29b7865
SHA51221e1e3a3de2d5e4c929920d512adab469756621551268b294c447d45fe3f12f74f5b5fbe157b70980b18f32624c4b1c1e92cd3710fedef19472adb89bb098a31
-
Filesize
67KB
MD58b191c9625c38ca050d8ac0228ec6fb9
SHA142055de3e8d203bbd83871b16c5270dad8547c54
SHA2560d78e473a2bc41393501fd2ff6240e68e4ece2968f5703124c767e6e7956ecb0
SHA512c6537ec0e6d3706cd386750e573ed3a3b16b720570c0ab29481057d5c96a44dd3e5ab8a8b3e5b5be2bdeb497ffbe9895686936f5afd27cc1e84395e4def08cd4
-
Filesize
77KB
MD5b90134e80be6f6104721a7daa73cec77
SHA1cd017af0f0aa564725bac82758352d8134c6bf79
SHA256e75e79eafb67795855267eecf755ea3478d66123f2ebf1b931cb1c3fff25f8a2
SHA512c311b0433229061a43b6747ef8f735c8e898c1a19e5eb37039dc1ec6bde5c26fb71895f3f5ad776343c969c033d78b6dee0598847aa0993ae6afa7b8b896b57c
-
Filesize
71KB
MD5f4e92aee3c138bc1849cfa7c21a5a9ff
SHA1e73590cf4d7cd3bf343dc0b4fc78745895c678d1
SHA2564e5c06e3ed7621c3ae282417e1569e6d98a758f27837ad47e523cb9cec395d10
SHA512c896b2539690c008320f530696052546c084268182108f061fe3abee81f0376c24b9771d00a09f366a2c6c27d2f9030b9a81c24c5d7618563d940e2c7edfa360
-
Filesize
75KB
MD5df390d5db1d27b3dcfc35f518c30aace
SHA1de5ac3d89481e1987222cdbc9eef8b00a2f1dea7
SHA25639033a331859b6390506f000417d274aa959165accfbaab21d508dc6db6b54d5
SHA5126d771d79b161bd9667cc3db2796c29206d8fe1710ac6b3056a2b8108eb82d73351039e161ff28be83b43a6b578d375da43e0a85af2252bd1d43bc08c042faddc
-
Filesize
74KB
MD5c3db5e21c2498a91efeb01ef4e2a2c94
SHA163aa5e9ecdeedeefe65cb551d85d72c105c34b68
SHA256a1c53aa09955f32aec9d60f79cd4b61eeb7794f910055f017ae74b3c06d8f24b
SHA5122c2ca4f4d0f3a8daa4c086dbc7e129129402ed6a160f702422fcee01bcf38f2dd99a74459395ccb3e83584557dd4357fc385e7840edc3aab8cbe5ce10cecf5d4
-
Filesize
51KB
MD5076c029ca0b3e68dd58b7e1197e08162
SHA1a20e94d0d148bc59daf7798fc187465b097d32b1
SHA2562f4b518012758242b0704ff3da3fa3a0d74388c84be69737d01daece2725a524
SHA512362b6f7e5ffd16f120493f4ee9383670943fce8bf48b0a72c2aba96dcb7a3897ed455f1c34004af595abb4ee25c89b61e7cabb2e3b62ae4c7e76d70687fb746b
-
Filesize
60KB
MD529516191c5235d853ec022380c7ed6de
SHA15f60645fc19d1d61a50b9483b22d6436a00bfdc8
SHA2563b734ecc96731ac931c52d11f92952bc01145438743df57fa8bb5876f46697d6
SHA5128a2ae50447dee5f4cc04507fa5dc1a51dd235654c72183ff0edd3e2c7111617660409e287d42b300326c0b1c21ac9845380bc86ac328ef8ee0612ca184bf0e2f
-
Filesize
67KB
MD5c87a5d6f5205842032dd2f0af2f2217d
SHA1b76db83094ccd635f54f7c9866c9f106842060de
SHA256ba35026ad26a9f67a050b88416abbec971540ea0b40bdfaeae13921779b874e1
SHA51268942162532429108188c77e0e72fa31c49c9b2ed02cd98a8657a70ed7589a10ea370671085c251010ffa8318b1d38d79f067dfe95b72251d6316daa81d8cc78
-
Filesize
68KB
MD58ad8444eb46fc9db5ddddbf6ca5e7428
SHA15fe7fe3c1c4d3a2d2f81e370533c90fdba7fe1cd
SHA256a3ce186422570a332aa41af2b36465105767d8add7e6f758a21f4be27dab2067
SHA512468de1277d270980efe3ff1ae8ac2a0d340ac4cf78cb0eb0234c3d2c5d0de8fb1e32c44e13bec111ff7030924cdbea4322e2146853c54306700ac57e629d66a7
-
Filesize
57KB
MD55a85305bf7350dcb3673a76ef0ade2fd
SHA1e991d2293368553b35535e323a40c59d74df7ebc
SHA2560ec224c78496f8271c26b3fe18beca00ac51e2b752383a405fc5f2717e7d5a2b
SHA51297ca92619704e6889ddab465064794bf5faef0f9fca31130c6252f8a75f87d137f7e9523879b482cbfb22229311e505851355d7aebde3145f18b0f7b538946bc
-
Filesize
70KB
MD597e9a694ef8d654b96afffa7f5f00823
SHA1388c3759b7dc16251a654454c23ff6ad8e11021d
SHA256fda4890c21499ea1bd5a26c4b6b97a4eed99f327875cc9168ac2479db675e95d
SHA512cde3fcdf401f1680202cef491f897bb3d28355b6999b391157a94807e20e973891646d275ea262d4614bd16fbc7c0cc88f47835ea7c0d316a0b808e9305b32f2
-
Filesize
68KB
MD58ca5dda422efa7e39c9ebc7b64881686
SHA130dba9ba843067827635442349ac71b3c7594ab4
SHA256f406e2c73589353eea644d1b2968579186134eac35bc9a4cd6662266e4774dda
SHA512c823fe5f46f5d98f563c63b8bf1eccd2cbc08e66904492d105e8788ff9b594436f26f6db5654293d629c2390d14680c5f653ae427918458f608b62a30aeb9e22
-
Filesize
71KB
MD55ad42e7c11bde7cddc74d05d8ae296eb
SHA1572e3836dd63839292ef4154d3c08bd839d862a3
SHA256b54ae3c9672428dc101bc9016ed8e1f456f56f1e5ed3b3029aff899417fc5071
SHA5122a24c13ca82b9817be59e5c3800420c1800b0c3c1e0e4065c64137ef148fd1e515ffa565206cc10c590da6e0569fd1ae4784d1d9a6dc15d7e0e4521702dc3b36
-
Filesize
61KB
MD5a91cfa61c1619d5ddc7b67337f40c461
SHA1d47f11d3804a4108e7011212b752161e9b32b66a
SHA256626af4bec3d5937f6cb87dae0173b72213cc6667f4978b7587e5c01c439870cb
SHA51292078a4489184aece69e3d114cdcf06181693c0e9526f7b698c1002e3c0bc207531e582c54f754c379296f920c0b14b12768dd3e3fa333c7c1a976942e9d8fe8
-
Filesize
57KB
MD5c609d9cb1786eabc73151db812927314
SHA1b1c286bb8ef437152f6036c3f8e06ec823f707b9
SHA2561fde296a1750e4a431bc4b978989a1b43a51aa8b583390b2e8968a278fd5d2ac
SHA5120d9c69eb45c4a0e86d875e929a3f93a89e908b23457ee1f80d754733f11a1d4ae07bd94b7cd6ff141ae597818b46b91b3de847ad125b67fb613a24b29f33436f
-
Filesize
70KB
MD53422eb8e002178f59c92355c1ca78393
SHA1eae49e0c467a6aeba668b5ee6adabb393a57e717
SHA25614ea295a4db82f8890e935c21c4ba92c86de3a674aedf323099689b0bb96a7f9
SHA5126945496d88705317deceeac74d8f8279b16cd77ca0ac20772260dd77178c099a57338010c927a1591c515fb05bf73a9ddac4e9389eb0de31c4c16341555e2342
-
Filesize
61KB
MD52dd70baf08ca9a226135fc5c98056c1e
SHA13769412660cd5f081bf7f3c4ac634cf0a1b60362
SHA256c1fe16ad8b9e00e8f0dbceafe0be6b68c3d91801c444c6ed1ad46549e56de44c
SHA5124900594b3bed48d1c93801c07c49d21255aed5e030365878f8fb5db9583a5a1696b2010d463b2d13f480bd37e2ff1ee45784e0488e5cc3ef18b9b600b157e10f
-
Filesize
6KB
MD5a2beb8c9737232a5b4880405041bf734
SHA161bffae85af39ec031994be4b2b2377423149f38
SHA256d310e49b953298601470cddb42fa959212d36917da3bb75fbb229404da0c72c5
SHA5125435d4e0c1fea478ca5ae320748733fe0f6cfe97be9541f233b0c3e3f6e109994dec04ec04a7cad6ce56b84d5a8b596992afa888b3e8746d282681b1943d5336
-
Filesize
141KB
MD557086b02f74c3fe7b79a5e2e3d852322
SHA16420387225ddcd5210175de4f3fdb0ab2be8ee9c
SHA256a1b5be8d4aab349aff58ed34e1f3bc6647cf440830da0a12a8bd5a1c976c6407
SHA512b195eb9a9129863e75be603b00b85ecfe46360910529fb38513af6940f9d17efd56f234b47963452329cd85b16bebb5a85ab5d304743e57d33bafd5b59900468
-
Filesize
50KB
MD546b4d311088a1b5476ef5378009fb040
SHA15f4e068b959d6b52a46f4ce9bbca3149fd3178bd
SHA25633f556efb669f0078999e06d42d3d29393a3909e6775f3fc2eb59e28588b6c14
SHA5123f85d8f6eaea9c8d39df16a527b9d78faa67549af4c1e4ae59fa7bb6bc0acabfb35ad808cfe94fda07e60ffcff26e0c0b508f39e1aa6ecbf63dd9da845128400
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\SSLErrorAssistant\7\ssl_error_assistant.pb
Filesize2KB
MD5e2f792c9e2dd86f39e8286b2ead2fc70
SHA18a32867614d2a23e473ed642056ded8e566687f9
SHA256ac354a4723aaa4f06bec385ddde4a4d0983ad51456f52b31a8068ec97d5b5ea7
SHA5126a7af0ca1efa65a89a9ca3b8df0d2e24f21d91673c60cdfeeb02d33647442b01d535497249542f40e66e0d2dd3e9f8ed1f4a201fd97138d07a2b71366737e580
-
Filesize
163KB
MD5bd6846ffa7f4cf897b5323e4a5dcd551
SHA1a6596cdc8de199492791faa39ce6096cf39295cd
SHA256854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666
SHA512aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\TpcdMetadata\2025.1.6.1\metadata.pb
Filesize33KB
MD50f83ea8aad2d94a32037e90f2812611d
SHA166a2879b881176df793c94f6833441fe153e5135
SHA256628b2de57b5dde868a30e9c45ffc6ff35a820c93a90d3f4ff61a1ff5396eaf54
SHA512e676aa774c099e43c00ecd42d2f10ae194910d9b694629abdba763aefc1d2c541cb1133ad3bf74df08fc6f8fb32b3f3047c07375977ee8d0f8bad9eddb7bc388
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\adcocjohghhfpidemphmcmlmhnfgikei\1.0.283\list.txt
Filesize149KB
MD55f5455741ebf6bbb4293184c410b4414
SHA1f97f61dab887a098bdb2ce5b2a5aef020f54e5c4
SHA2562f0e8f3d3126a613fe37503fe314cec4553d7c47cb1d5dc32dbb4e2a10b4709c
SHA5125629aa5b07690e73bf246555a8dab56bfbca07d62571048fad6a58a97fd93b09be93557b40667c92f3f6667530e1a0757b76d93812e0d11ee1972e0c690e9f5e
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1025\1\Greaselion.json
Filesize3KB
MD57a611abbb6a9a924867db6020cb190d0
SHA1e2f19e2ef273b9f5ae247873ce3306e774961d3d
SHA256b080bd46957a74b2d321e701237222980c202f4139bc4c33056e8b8824f64402
SHA5126646e87023a890e63c7c7aa6b006b41dddfc7b9005a9d70fc114e45614e8bb652fcf4450f7bdf6326d31611d4d4c12f40cdd690313d56d6b214682d98a5ac898
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1025\1\clean-urls-permissions.json
Filesize268B
MD500acb0f14b6b6c11ce80107110ead798
SHA12a40b0217ddea6d507234f236d3889b46ee35baa
SHA2562e666bd0d92b08bddac4487b184c5612dc408f21fe4f3fab78a7ce1b2fa3f8ca
SHA512c3a53397be2fcf41702524cb42c8d2b49d4cbde4c5479c6d0d6e92152cd213dd7436d7729906d76ed003d64e806cdf66dda7f3ca8dd4b9f9efabe25ffb76c2cc
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1025\1\clean-urls.json
Filesize18KB
MD53e6714a16e04d03f205a85f2563eb1aa
SHA1a76641cf3a4745ae2e4426fb10b73a6af4f1f272
SHA2563c09ee2c055819d0ce5368cfcb19cd5384e2916d7a5c2332f59ed60b3545b0c0
SHA51205062fd40cf019b7367c2cf65d2fd219fd4e602111e9bd20b76545dc890f20fc4d1ed798d630bc0821d52ef4c35bd83e63bb84971d10f162d4c6c12eda8526b0
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1025\1\debounce.json
Filesize11KB
MD5e0df2d0dc75d2deac9eebbe0ba8db9ab
SHA1d0636e518045a34eb081096f86609744fa47ddab
SHA2565f05b84687de1011614eb1ededfe23d6f98fb2be47ea1a04bae0c95d9a3113c2
SHA512c086e251cac5c121b8841f0dbfd2a45af99991a8b4bf584727c6bbe7e1e52d2361d2ffeb099be5da937b17d3ea36882d7516ebb294b5f2ccd9959424c2a5a0e0
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1025\1\https-upgrade-exceptions-list.txt
Filesize86KB
MD5b8ebe8c70e14e1bdff4bf04cee9055a4
SHA16a8eeeb539eb5f630091a971585bc77731c24b12
SHA256a9c464c1aa17ec9958141c020c30badddd4801e15b9c0a0d430859df0ad1955e
SHA5129240b1d7ae17b6d20cb21a466335471d3b62ee2866e6d07dc62c1a288def513cedb5368891e4c8beecd135140a221bf8a16e048cced31b29fff9f8d0d40c7266
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal\1.0.1025\1\webcompat-exceptions.json
Filesize6KB
MD554b1343eed0640cc4b415bd1ef50dba1
SHA1df0a9d4bc264e7c9325a9d082ddb3ff8dea528ba
SHA2569344abffe1529919decfc08c1f171600319625ef7ec9a6d63dfac4927d6246b4
SHA512c7689d95879d890425e95322613167cb6be9c04f207e847fa3f6da4c752413325968a667fd3044d8cf08a74537a1affaffd02dfa33397079bdc603768f757e92
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel\1.0.15\StudentNTP_Sam-Richter_x0825_WINNER.jpg
Filesize544KB
MD5f66e5fa138432af6b40849484545b809
SHA125942df987649a1bddda636686064d29dca799a6
SHA25665b5f21ccdcbdb23f39baf036ae5eb3999f3e88e241bc57a3a4d1bf0fbfda605
SHA51229a512f0f028b2c4e53f492f6a4fe27cc88b547334466341b08b70724b16e7eaaf70cb0308e251f404aa6b80db972a553438afc3894440e1b1ed0962ec7a5319
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel\1.0.15\photo.json
Filesize6KB
MD5a7e80c8cc5121a2febc654140e53ac32
SHA1c3b1b578dcbf91aa19e65d0ef6974c165723828e
SHA256a2595174656b59176071c0b79b404efa7246a9242c2bd19545155194c6b8cf99
SHA512d7ef1e8df49956bc212388ef7a5343b9836e825c4ff066aa65bf0f3a136ecee4b63ff807dd63eb33e6e812e470d644eccaf3a7f61a816e441ffc44a982690577
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\bfpgedeaaibpoidldhjcknekahbikncb\1.0.10543\list.txt
Filesize54KB
MD5262dd57421040a5921ea34eb5de17986
SHA1383dbf524f3291be8a1fcef5c8e8d93c169844dd
SHA256a72856c53e7954ebfe6fb531599c04152d32384a0009df7bd45e9827f3ce1d6a
SHA5125a6a9cb00dd95ca210893d136ea4481dde07d53352d92f8500190e3b27f5ce5adae0c6d8134b33e9b118bdddfc1a27953de6b44b621061dafadd2fdc8276debc
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\cdbbhgbmjhfnhnmgeddbliobbofkgdhe\1.0.11714\list.txt
Filesize1.4MB
MD507fa9b64cddebc416dd01a01c27f59ce
SHA14d356a14bcd09e6b8d0cd92520aa439da893a6c3
SHA256cc4ba85e1e33b970a0022e5d46ea3666a190b5e1a20915b4aebc7f70878b9a5c
SHA512a1ee8d0f0ca78b2a8398d4e7b93e735fd9f0c59ec949cf87ce37e85d504595f42359fad8c3eaf4ef873be93c774b2d71ed6986cd73b97a86583bf403c8aa1041
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\adcocjohghhfpidemphmcmlmhnfgikei_af0c3b4e4f6e5a6d36a9e48d7fc2a6b897e9b489074c17d563f899ae06a3237d
Filesize50KB
MD5c585ab88774559f466e99ac16889b9f2
SHA1e69ae7851e81b7ed095be003688e860db838c272
SHA256af0c3b4e4f6e5a6d36a9e48d7fc2a6b897e9b489074c17d563f899ae06a3237d
SHA5129405d7de2fe7f6a75fd786634bc8e1e2d3cb2ade1e82984e1369a8798900a8e5f28d1627ac09ad93e5e26e621ce1c2ef8bee7596ee832030d009e228b3eb8439
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\afalakplffnnnlkncjhbmahjfjhmlkal_a58adefdaf784d8e18be7361cc1fc0754006ab0645db39e030cbd2198fa1635f
Filesize71KB
MD508e05280d696d07c593d854939f5797a
SHA1044db06c4654fe2e82fa2bc1ed4da36ee95fe323
SHA256a58adefdaf784d8e18be7361cc1fc0754006ab0645db39e030cbd2198fa1635f
SHA5121e18235702880626275e41ffe5bcd81ed0b44e790980da3356cc924eccd9f9437bd1268e9a6b2f94ceb648ba740001c7b91b77e8d24ed9ebddc095806d7397d2
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\aoojcmojmmcbpfgoecoadbdpnagfchel_9f86d8efba865ca6f98389b7c55e368191b7954cd10b872da84de0b5382a247a
Filesize12.1MB
MD589c01a540e21a6012c4292eac6100dbb
SHA12bf600a9d372f38d37c64a9df5cb26d5cb046cf9
SHA2569f86d8efba865ca6f98389b7c55e368191b7954cd10b872da84de0b5382a247a
SHA512abd83f91b97c9c9bba4cb82501a6d316ef07173e4916e87a13f888ad32947b424d18bd6186a36245b2bd9f6c6cd29ccaaaf2445b3e5754c30ea53f1ab6016f25
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\bfpgedeaaibpoidldhjcknekahbikncb_9c62d120b9dbbe41d27008c5d5114eaea784e552e02af7e4cd2a19b9c8b87393
Filesize18KB
MD5c3ac78eca3de7c0e238f8599337fe2f0
SHA1220c74e6e7b096a052056d2f26397e0de5175821
SHA2569c62d120b9dbbe41d27008c5d5114eaea784e552e02af7e4cd2a19b9c8b87393
SHA51259863e9be405c61963989c95a87b91808d6059e5baf7aa0b5477f2dfb6850ae2287ddf6d0b7299100e587845eaeef43619b3a6679a7a1d781d9dabea8cf00903
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\cdbbhgbmjhfnhnmgeddbliobbofkgdhe_3dae87e0085a88c01f809337774b8f671525855e9207ebb9e662318b7e1e8841
Filesize414KB
MD59fcff2e1cc20ba7670271df1028fac6a
SHA17502f0e5953b7c8cd7d9a6d28efbdb6732c6b5af
SHA2563dae87e0085a88c01f809337774b8f671525855e9207ebb9e662318b7e1e8841
SHA51255971103716adf42e13f27603f52ba84258ff6d1a766884f73725f84011a44e28d81d8009cfd0ecaf527981972ad8218b4e5d80965398fab252b13b6012f1a3b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\efniojlnjndmcbiieegkicadnoecjjef_1.9645143596dd859c7d9cc843cf13378660ea1b16e7689770d229142a0a3724c8
Filesize150KB
MD5e1900863188285f81af2e44329c5dfc3
SHA1fc1234b818d73e3925c9e308644c39b7b0a1eae9
SHA2569645143596dd859c7d9cc843cf13378660ea1b16e7689770d229142a0a3724c8
SHA512be5c29c05ba5a79118e5b4d3223c27b50a00e89b429865267cc468a447fce91ec6e27fb5efef108e362a9d5722ef915cbf453199253b8b08560247be2566ebe0
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\gccbbckogglekeggclmmekihdgdpdgoe_7ae9fcf993f68854c48606c69e5456b84f6cb59cec730bd45b11262076c2470d
Filesize1.2MB
MD5332676df5849a5a90f9ed4d9b1dde14f
SHA106913ab5f20a32c129fc0dd467f785958ed97071
SHA2567ae9fcf993f68854c48606c69e5456b84f6cb59cec730bd45b11262076c2470d
SHA512acb356e36a3d898baf4855a32eb0704e8653f50cddfb0cab503aa5972088aef9a2cacff83a1f71220e2a3d3b595537f40a62067bb8bd5027806a3fc215609b20
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\ggkkehgbnfjpeggfpleeakpidbkibbmn_1.3525216abfc685f109e0efae397d7afe8bd1aec6d081fefc730947cd3e734f2f
Filesize10KB
MD581c39099b5a4e221569eeec0a746af7b
SHA10601105a54e905370e965cbf8cf78bd6d8e300c2
SHA2563525216abfc685f109e0efae397d7afe8bd1aec6d081fefc730947cd3e734f2f
SHA51242011c20c52733df0116c4661efdce06d8ec70dd38cfae2cad45e4b4eb7cb24ab4061e968e4d5766e4203b8c4caaf2b6727e55bdf78402157a19eca0f2e89140
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\giekcmmlnklenlaomppkphknjmnnpneh_1.3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
Filesize5KB
MD5636c653ec2c30bb767533901a18669b2
SHA14b5a01cfea4c5deb62f3aafa01ef24265613b844
SHA2563eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a
SHA512a4128fb20a5df9e573e92b45f5bc18dcdf4be6e7e39172d08847882f17361320141e89b35deef337e40c365d6f1ccdd1b991eb4593d805dfa2e39a5257c335ee
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\gkboaolpopklhgplhaaiboijnklogmbc_9b0a6f79321f3960467e7d3e3b3e9817d3ef281c405da30852606bc8c9cc588f
Filesize76KB
MD534f31f85a6b2a69a074939e4e231a047
SHA197f6d1a966baa94e686aef7fece23bbf099fb8c6
SHA2569b0a6f79321f3960467e7d3e3b3e9817d3ef281c405da30852606bc8c9cc588f
SHA51220f4d9efe5450e1f02608d382c97bd4269298c87763a4abcf63a5fe0ba62dd0c391824964084cc011ed6cd7db99c19c9b6411b04d42539081f3737dc78a2f2ed
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\heplpbhjcbmiibdlchlanmdenffpiibo_69d8f36372ec6edbfc4bdd957f954cc2aa97c9dc8c7992c1575b072632f3157f
Filesize4KB
MD53a03f3ab4119a23fa6b70a32a6fcd4b0
SHA15d047a5da7c7f388416aa50b5fba745bf5f36eb8
SHA25669d8f36372ec6edbfc4bdd957f954cc2aa97c9dc8c7992c1575b072632f3157f
SHA5128caa4e94e831b25226e956a8ee87c5b369547081df863ee34e7f80d686259eb9b7bf75757043ecc5b0eda3a603198da060f9b6f30be755350ab912fdc7681819
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\hfnkpimlhhgieaddgfemjhofmfblmnib_1.a15da3a7e848826e5277be2aecf58ed6e62750b989f4d13ccd0931235d341eae
Filesize595KB
MD5f7a991c294a1aa710833441826dce077
SHA177abb0a5c41efdb264c794760bb9a5df086342f7
SHA256a15da3a7e848826e5277be2aecf58ed6e62750b989f4d13ccd0931235d341eae
SHA512cc5f70cca942b34441aeef37eb193286cfcec633423f3be181b926d21b44c6889fb32744f70882277fefcaab515770c74d1e72fe9242dd2065dd0ac27e600fb9
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\iblokdlgekdjophgeonmanpnjihcjkjj_44fdfde835126a128fd9f020a2d7c388491ab5d251a107e4e10b6f24b63e7d72
Filesize17KB
MD5a1b36d762732f9439efa78708a40dafb
SHA16533b78ae795077fa711c67347eabdc88b5a6c6b
SHA25644fdfde835126a128fd9f020a2d7c388491ab5d251a107e4e10b6f24b63e7d72
SHA5128dbfd514f87e7b929ab9d2b61f99939b3cf687947dff980ce3378b56127785acacde7b8fb4ff034e2a31f8cec1901605c6216b6846f5d2a199a245bf6144e05d
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\iodkpdagapdfkphljnddpjlldadblomo_3f0dd6bb4272b8ed316fcdf1b83a42c5c79ed9d90b4116f832235b4aacd7afe6
Filesize1.6MB
MD53d291b4ff86952e148fc001a548e308e
SHA10ef9e15b2b92a9f4775e742e1a5cc28187c7b15c
SHA2563f0dd6bb4272b8ed316fcdf1b83a42c5c79ed9d90b4116f832235b4aacd7afe6
SHA512fcd4f4917e8ccd87e944d4282343e099b4de882f1cbb3b8f7c1f6e470a5e1d4f2efb23a2c5307630c4593e0f747cfc48c65f26c029fbfb3b39c7b3c96c0db7ad
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\jamhcnnkihinmdlkakkaopbjbbcngflc_1.c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
Filesize1.1MB
MD52ac309d48a054c8b1d9ea88bac4dbd6c
SHA17507922d88a9cb58759b5326fadae5d0c87f40b2
SHA256c52c62a7c50daf7d3f73ec16977cd4b0ea401710807d5dbe3850941dd1b73a70
SHA512870dbb86a67f36a43ad4c80db904e76b602bbe062cbb9fe4222d1cc69d99aa4a60aae91c094a65a481d8c62cca4942f178f1b2744ed21836a526c7ffe3409969
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\jflhchccmppkfebkiaminageehmchikm_1.4a54c9608d3cd43d98b0a7efb59dbf0dbb96a894b590c8c12aa887d919a3fa62
Filesize9KB
MD50cb054719539c9976740cbf6347deda4
SHA1f67b7c673822110edbaf783c4ba6002914f233cb
SHA2564a54c9608d3cd43d98b0a7efb59dbf0dbb96a894b590c8c12aa887d919a3fa62
SHA5127da4b2d87af6f0601479417cc6bd5390dcab2aefe03ae9414bd7f9b8b033baf8b7952eef7d1f9f465d7472cc14b40bca37c583e00fd6508d5388c19db1c26c7f
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\jflookgnkcckhobaglndicnbbgbonegd_1.e698359726dbebe13881db2d3d53856d8a3a1ffba048ac94773036cd08a60240
Filesize77KB
MD51068b68cfdad67e39e13fb7b97adbdb6
SHA1d3dac92d9c28b948ec33699ff69ae75a900de6cb
SHA256e698359726dbebe13881db2d3d53856d8a3a1ffba048ac94773036cd08a60240
SHA512da6c4d63d8d22e231d5101d93429a3ecc33c89d62b5fc969c7276816d79f8cbe45a16652507581480edb83b61f0e1c57f41e4432f6fdd67c878f38e0d4eef64d
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\khaoiebndkojlmppeemjhbpbandiljpe_1.44c97a8527ef50cab95a16c5e78cd321cbdf315726823afe7e0482af9eb18319
Filesize5KB
MD593e97a6ae8c0cc4acaa5f960c7918511
SHA15d61c08dde1db8a4b27e113344edc17b2f89c415
SHA25644c97a8527ef50cab95a16c5e78cd321cbdf315726823afe7e0482af9eb18319
SHA512e61727a277d971467e850456fbc259dad77a331873e53e3e905605cd19b01c2dc46df7400ce8442e39cfac5ac3fbcd833ec7310c7ab1c3380d900dd676ed1679
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\mfddibmblmbccpadfndgakiopmmhebop_bdf60991017fe5e955ab0be306333b5427fac3db247bad1f24709d4c9c4b6ef3
Filesize179KB
MD562af22ce07e0375e66db401f83384d5d
SHA1468b255ebdfc24ff83db791823bca7e78b09f3b1
SHA256bdf60991017fe5e955ab0be306333b5427fac3db247bad1f24709d4c9c4b6ef3
SHA51254dd31001427a97665dad169b0d5f32fdb79a89eac7fa23a164bf78095be2d2e5f9195eb9ffedc2d1998f839781e32515baeae482ec74d8409b0d58fe53993e1
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\component_crx_cache\obedbbhbpmojnkanicioggnmelmoomoc_1.fa5d70ce715434cda9953be8a723c89384b00cf99e931dd43be46fa909f83371
Filesize5.1MB
MD5ba2dd3578e017160515508a271b9f664
SHA1b5898eabc9b14b4d2b296a757ceb5468a7ec1e69
SHA256fa5d70ce715434cda9953be8a723c89384b00cf99e931dd43be46fa909f83371
SHA5125adbc5de11e3b153781e362c23464daf543970ea693f0ffe43dfa393de6cec13a54d74a82182db1263c59664722fb5ae979345a4bf50dceef8441544e0d11b79
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\gccbbckogglekeggclmmekihdgdpdgoe\1.0.1843\733265a5-cb2e-4388-80d8-41ff2aca4f74.png
Filesize33KB
MD5050c997c097ff116d74ebfe55e4987f9
SHA16e150b6df1b0bfb17558f6af3e455619b68f124d
SHA25603317454364bc4692da57b78a0f1fab8173b364374f5f165bf536115a37dba88
SHA5120be0912147351e713bc09bea22ed485d0761bc442ce5a73053a3ac81eb9c8cd2f917132a0add117d44ccab6c15a90b547e4f3a7c10f86f7f500999b854d683a1
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\gccbbckogglekeggclmmekihdgdpdgoe\1.0.1843\d7f67249-f019-4471-ad6d-6b66323241b7.jpg
Filesize385KB
MD5120738eebdcbafacf867275bde67052a
SHA17c65e8a52a17a9baf9a21433c51a950527dd669c
SHA256e291c22f5ac81b04d8e7aa71eab41dc4ebdf4e02b855ebc069915200bae737e1
SHA5122e22bf34a08dddea168ebc00e2269f84456486885d5566cc7e8647d793138b6e523da7a002c13520410f4c972b59e0e2a78ca6f7b8d4d1f5e7615128e0b8d98f
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\gccbbckogglekeggclmmekihdgdpdgoe\1.0.1843\photo.json
Filesize3KB
MD57f469d0fa115666441b89b6071e83db0
SHA167ddb4779574f6aea3cfe1ebdf4ac7fe689bb5e5
SHA256800fc7488d95825f4cf8edc45a6d0241a0f5e217f4c35b68bd82c051dd8ed249
SHA51279fade254ed89f9179f12504a6b518bfc3d01552d5318121432b6255a8ef8cca4381264a696f1392d84a4066d99b82140d23e2a79ea2fe3231acc1f3ef45383a
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\gkboaolpopklhgplhaaiboijnklogmbc\1.0.69\list_catalog.json
Filesize76KB
MD5d1d6a9d9cc2ada3f3bad8b0da607f4eb
SHA11d286de6436a8a28584744f022af73077ed64601
SHA256f1a889c0f11e2642c299774f601b72b5cc51e86bb1fa7514cfa9f4fa1a9538ad
SHA5124c43a10995b91d2791a8274813f005feab48d83078fb8b51f026266ff524ffbc53c41d507d801101a9a7f765453ab4b08398f4e743b6beb08036b72e40b82934
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\heplpbhjcbmiibdlchlanmdenffpiibo\1.0.11\mapping-table.json
Filesize4KB
MD557ff689022f2d93d2287ac3b48daec73
SHA1937b7dc21193a27607340af7fb7b987b8ea50582
SHA2564665c8cb39b1fd0131b72097484bd3a8309992821a21de9ee0420434cc3f7d5c
SHA5121b81c2c9df45875c2f563b99bb2d29972408e3d449fb2e8793822dc0cf85c41cb48eb92510f4940343ae4826ec9bb4b98093d64f53de635ccf75b5307b92ca87
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\iblokdlgekdjophgeonmanpnjihcjkjj\1.0.106\resources.json
Filesize269B
MD520effecf10eeb0456cc6f537c802f172
SHA18fb3968af27ad30c639f45a6fcee99b48ef79878
SHA256044502a67e39049b4cfe2b80295ad396fff4d1a28e7f2a1200abf21061aace8d
SHA5126a002b205519c0fc498c139d1efcab2f26bc03f3fa795a5bee9b3358c9796088bb6419e2b95afdbb84c5ea36a328dfab01b33c148c84dd8e3b9d21fa07fb6dce
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\iodkpdagapdfkphljnddpjlldadblomo\1.0.9952\list.txt
Filesize5.6MB
MD5c25ad1a329b6431052a09ca5192eddb1
SHA1e3a8e1e1d92cac2a00cf50fcd5ef5427f09059ac
SHA256a44bdcbddbd27a88fc56d212439ed9f4fdc8b80c5692bf278870a91da34efb41
SHA51244ec2ab426cd78cd0d822b68f0194b8fa07e244f54d2739c1d9fb82615a75da220a1a8e2f6844417b9937a34fef95e621bf280382375578a1c3ede5218af594b
-
C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\mfddibmblmbccpadfndgakiopmmhebop\1.0.104\resources.json
Filesize1.2MB
MD5f7e232619fcd50a55c3df6ffbab0245f
SHA1f26eff68192fa88acc08ed97979c258f8f534a33
SHA256f4e1a4ce5d42af762210fc9218115a1048d3564ffbc987b4c47f1d9321dd35e7
SHA512bbe0d62000740c6958e8630af812bc388011a225785e3f8b3b7ccdf2e033a42d63db566df030244ac22884d005f5f2048b4a506ae64a8e7062395b8bf08430f4
-
Filesize
649B
MD594f2e947f3afe44d1a01214e4a33e6d5
SHA1c428a4d671ca0eb14bcaba50fd37896bdec26ec9
SHA256aa3002818a8ce908a59de1d2d67ecedb2daac48aba4fe1d037be84c52cbe6d5c
SHA5121876539a1a4a0cb1600ada85080a2bf4b505ada1ce32c43fbe5d2c7170775e9678c0a495241ae36c50733eaff869535bf869c6641744386b88271140ddb82bdc
-
Filesize
215KB
MD5d79b35ccf8e6af6714eb612714349097
SHA1eb3ccc9ed29830df42f3fd129951cb8b791aaf98
SHA256c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365
SHA512f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a
-
Filesize
912B
MD5484984b01e0713b1f8e0d010b904167e
SHA10df5d0fca161c3b7c554a4cd0b25afd980a0140b
SHA2562ac9935b8bc3c5b1f90a349e8c08fc02cd227768014a1180316fc42a30247773
SHA5122dd8334af383244417b7f865ccf69d9edad2f34d8caf439f1b5c7d63712b01006585cc595b595915c2928593ae7201473a025c2cdf9c83efc9cb2383bab91223
-
Filesize
6KB
MD5ccf792666fde09eaec5852f3d328ce46
SHA1af8af807b0e737104c2abd25977022ae6b4475a2
SHA2564660efcd2c59c79ad08bdd04a511d8ebc5fee832b972d00a40060d303de5314c
SHA5122a5cdf9f37ac7daabdb6f8e2b76b434761c165806ac620df531c2cdcb63f85ddf5102a6ce77092ca6d8530ae25a838ac7763c7222e668dd21e3dc1427878b81f
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
859B
MD5f8631dc888de6eaed761df5421d14a82
SHA1180d7dc9edacd6ee0f01bc0d05f13d0ef3b234be
SHA256998be4722eaa8e438ab2e2a10d77e12bd199c86235a762eb6673f22f805ef5c5
SHA512c59c559cde1f042769f092d00eb790deda3df75046f63f1b1889716c78d91218c2998f2c378c97814dc8d3c3354ac8da084d4b537a1d547d22c8be6c0107617e
-
Filesize
1KB
MD57af32c736d5c3c05dcff86fcad6f2e67
SHA11d2f787c0f92c5df0937c8e6936688205960115a
SHA256cbf593419cc6c97eb4cca5b7af80e84a9a57d3b417dce235e86b61abb71bf8f1
SHA5121de9cabfd69233e4c7c9319604af7af900605a4df3c4c6c9b675bfc497d51b5f2cfe81f72c002ede1d214c319130cc014ffceea788068d9113600a6c97f9f4d9
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD55729e235545a152787ccd8cdf4f8b613
SHA190f1e28ad2e07ccfb3c3df03f772ee9db2b88ce7
SHA25662989f6ed3269101ca64f50a51c2d2271693edb2777acbdde7651bac9ccd066f
SHA5122ad858ad2959e36c8f5e0d4b172eba3b3df613cee82da17a264ed7b31c9a5fe1d46220158ef57bc4de5b8b11ac98d88e7b2b2b3eead12b9d81d3ae77fced6e74
-
Filesize
11KB
MD51e8ded96e8f4ef098e06184f00522aa4
SHA183383840d79aa2dd16e7e028026844ec215e424a
SHA2560695fc877132020f04e16983c12531c2e6a47eb222bd759db540f946d12e3f72
SHA512e48654662f4ac6f6ea1586107145a17699e906df3874ffff0a253953201fe45710e3918de75ee63023202e6ad609a52017282d037dd268e507ce613238a80d88
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\424c192c-ce60-4ea6-b692-d93b67e04b70\index-dir\the-real-index
Filesize2KB
MD5aa13935766ba7ad123215e58ac452f67
SHA1f32e1e86bac483a3c2923ff7b50359c549c281f9
SHA256f37c4332c9259f1701037116d1399150325736282d12b5e4041af270009e4125
SHA51244689087519058795923302ad57736977b9a70e5c97a028ed58f5b66ab08a0975025d55e49878b44c09edb314d32b560ea0953704ae601dc9b3833324824c8cc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\424c192c-ce60-4ea6-b692-d93b67e04b70\index-dir\the-real-index~RFe57c033.TMP
Filesize48B
MD50a9a2e66bf286111b96c8176c706128c
SHA193548a964b3b906b4af323ece4e4cf5f02eb1a35
SHA256bb87fb30c3edd68559c12abf6683873e9dbcfcb304dda86f6ed894f0e80af28c
SHA51237b71c36dbc7f340c6de948674f8551833b7b4617aa682b57b37ffa408be5e62fed0381d9ec0772db0b439900b770a349ad62bf4607c56af3f9dc4fc9a36c481
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize176B
MD5f379c406233e45136b7af8fe452efeda
SHA1029fc932e0603722e6638eb38960390b8236a551
SHA256a8fad8b588cf3e1a07f0700f4bff8d4d13ec5a85bdac6d13dadc525f18080f1f
SHA512617582605f05e2132871f4b51059a914497e1badc32b3e0114f99019279121818662b547fdbeb11db50a5f62ead42cee8ced9cb807d8f33cf9a3eb602caa10af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize114B
MD5bbf85a3ef0a43325f292bfe9421d24a7
SHA185b6908ba30e358cb7d69d44335c6a4011979fa9
SHA256b5d228cfc841f014ba79c28be137e2c2c8c4c580c6ff986f98b848b1d41d1b6d
SHA5123b90ff1c6fd7be6fe3c2610d332ff1cc42438ef54bd943cedfa1d518efb2695f81258ccb3e4ed516370f24839b3ad6e24933a19dff88051e5e697ae5fc2a7c5f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize112B
MD51e4b7b357829abb1f9b6985a8f0e725b
SHA1e09f7dc38c656624db3134a4ce641347bc128763
SHA256abe5ca1fcbac2d865cabf1883790204358390874aa432b81405f34b973c85ee9
SHA512b56059467f09551af265c53027127645ec926a487779b0b2b32b84f471941f17d9026d06fcf897ef48e106f8306e13ced4069d69c745b804a5d28df176729ee2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57b120.TMP
Filesize119B
MD50c18d54554579905e6acd8d90207c6b8
SHA19ab376a8fa025f6fb4bc485c71e58e0f8d946b57
SHA25690de242bb04312fcea0613ed14620c1b2647f1c6f89c4aa2c6c3d0d382d5859e
SHA51284ebe43227f2bedc57c4dbc0271e90da16e32169cab8762edb89c978fe13554a960a652b2318c7e625135e1298234eb0cffb214bfddfacd1ca343f53fceb491f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD581f9854e96947b9622a3638dc8a35f0b
SHA12d67a6fe874284bfbf36a140a82623506d479aba
SHA256b49e05f8a315b4e71b8569da2cd8b528110f22971dbd1957df47af9909a6b54e
SHA5128d0d6d3e82af3f30f9ba31200edd478241f2a977cf8ff92f8df2b67552198b8d6daa8c37bf02cf6b8d3f186599552c5001d0dd2805c78012805694073b620f7a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png
Filesize1001B
MD59b4d2aa85bae2b94477371dba6544b2a
SHA14dd2d97aa25b2723a91016ee5b403619e7a4eb99
SHA2563af45701fd97bc8ae6ae8e9f999d5d8b9d61a9a7914faf6518450f454e884223
SHA512f6351c370d91a87a2b0abd8da8460e65a8149700beff2e819074004101133e750b1e60ecdf6ead73d1de19f37258e7853084d65c6adfeab8707c480d9caabc93
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4784_1070749296\Shortcuts Menu Icons\Monochrome\0\512.png
Filesize2KB
MD5206fd9669027c437a36fbf7d73657db7
SHA18dee68de4deac72e86bbb28b8e5a915df3b5f3a5
SHA2560d17a989f42bc129aca8e755871a7025acb6292ce06ca2437e95bedbc328fa18
SHA5122c89878ec8466edf1f214d918aefc6a9b3de46d06ffacff4fdb85566560e94068601b1e4377d9d2eabefdc1c7f09eb46b00cf4545e377cc84a69edf8e57e48b2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4784_1070749296\Shortcuts Menu Icons\Monochrome\1\512.png
Filesize10KB
MD5529a0ad2f85dff6370e98e206ecb6ef9
SHA17a4ff97f02962afeca94f1815168f41ba54b0691
SHA25631db550eb9c0d9afd316dc85cdfd832510e2c48e7d37d4a610c175667a4599c6
SHA512d00e2d741a0a6321c92a4aab632f8f3bafd33c0e2875f37868e195ed5e7200a647b4c83358edcef5fc7acbc5c57f70410903f39eac76e23e88a342ac5c9c21cd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4784_609650724\Icons Monochrome\16.png
Filesize214B
MD51b3a4d1adc56ac66cd8b46c98f33e41b
SHA1de87dc114f12e1865922f89ebc127966b0b9a1b7
SHA2560fb35eacb91ab06f09431370f330ba290725119417f166facaf5f134499978bd
SHA512ce89a67b088bae8dcd763f9a9b3655ed90485b24646d93de44533744dfcf947c96571e252d1ad80bdec1530ff2b72b012e8fff7178f1b4e957090f0f4c959e0d
-
Filesize
228KB
MD5e12b67bcf4902ac2470d76d887b51600
SHA18072ac49c1305fac7858aebe30fa26fe1f16d286
SHA25670bae80e7674f38de503fa05d1b7f8c2e860f61c2893e8d4c3c317939a349e75
SHA5121504e2a91f9bd474cc7190fb6f594b0247a7afa4558470ed53e596cf62b0de319dab91beefefdab7773915691ac6371553e84762725fb034037268302b3bdc13
-
Filesize
228KB
MD57098df109ced75fe0d65b184c0109bb4
SHA16e87bda15a5a5918ad363feaadba9d16e7f494b5
SHA256b63cd0dd17dd558e0a09265f4ba0ba03b0fb485d1f0316ca290cb73cde880bf8
SHA5122d674ee320f36ae6a440ffcf524f9bee5c91a2fd40276b64bb21b3ebb5cef167240835b069970d5bb764d63b8b941da5ce18ee2ed998480ee7e70073392dc12d
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
14KB
MD59c5ee2406af8faaa51152e311f194fff
SHA186c400adbbaef2d6b47d482436ec7334f0813197
SHA25683779c4a5ff7a1f431a70fbadb6ae4661e19bd3b5c032e5e62ecc7afd7feea8d
SHA512f3d643f34b1a8ae195994963eab00ff4fa8a7468f5874ef0531b87d1e05e226f9163c82cede6b581aef3a71cdb094f37455e9c15f67ec318902e7b3c16015526
-
Filesize
4KB
MD56cff894eb7d2516e715eea6dce359798
SHA1f524ee36bc63c993f111b3ef5eba450289a837cf
SHA256a4b0bd9477d4a08f0cb57eadd98f4de77b674022e6fca5902f07d730a444757d
SHA5121431e08dac69e3b10845166a5cec9d0010d92bce72bd97a2f8f249d65e6e5eee55a6575f58f1d1a308e8a9a133665cc9b7c11585d8f6a11434da636451dad6a6
-
Filesize
1.4MB
MD50057df233fc9040968509a1de13086d8
SHA1217678d8a692efa2661a47d93cd0019587ae95d8
SHA256735081b6beb30a6312137ca5e2ae73dddd23fe091d9f8c6a84e15eaf0d1a4e2d
SHA5120d934454f2fdb6df0df49e23f42940ca85649c843e3a3360461a07e5d4970ae49468f2adb5754d4e3ab6be517eca0f3638f26d4d09f63dc08b7bc30468992a43
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Brave.lnk
Filesize2KB
MD5dcf40a1bf38d1671cdd6a944898f8242
SHA189c88dfad2140fcaaf0aa9b60e15836734cfc9d9
SHA25677b95782caac624c427fb01ea05a4ae4f82a42b88bc615f3106ed351dcf61dd5
SHA51243557e4dc834efad97c7341d91183b3a3fd0ea8bb55e80a3a711d5d65cd67255a8d9563f2bf68feb0996fb46845dd5fa118ce956b41ac81769ffad99208a39ee
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms
Filesize10KB
MD55f400a89aebe6a9929021c48203dd3ff
SHA1759bce2fcad2faa6342d69915e72c994c6f86dc1
SHA2560c53f78bfc373dba8afda59c408b2972f9062e0af1ba6c2e2bb2bf5a07ff8f83
SHA5122e52c78b9d47141d912043eeb70a7289e39adc64585438e2913b5e7f2fd7b4262dfb15f97a553e104eee477c713cd03d50c1348804486eb9a1c309a3511d7180
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
Filesize5KB
MD555eecdae9a3405cd06d66d563ae0b840
SHA1c27d040cb05d38c9736b5a7397bd4dad57fd200d
SHA2561464a751830b842f99b0163d57bb4561b6ed34e2cdad1d8c8f432ca24db53df4
SHA512b3cc377624cc5c662e971c870b19c6b54a128909e42ba26c2d0493f6c07a6742c6c585cd563053b3d8c71d70292463b89a5df6ef3ff767a9705cb8397ee1bcd6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms
Filesize10KB
MD5097ef6182b5d032a13d717c0564f9b1d
SHA1ad802c27acded167e9ea30afab410dbfbcc25d19
SHA256a3c1c7582dbf86385042a977b863fd1da5b9d2b4813ca710b317072ef3fce2d5
SHA5122489cc425a0315f666f4cf999e56569f7cd180072c83b171542bda4e28140a83d477bce7d065086da5d0b79ab9d443b9516c034d054f785965f21893271be1d5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms
Filesize8KB
MD59de32ff1c05cd91fe98ae10a79dcaf18
SHA17d76f8bd9f446e8b3a4e955243166e108d74c3d6
SHA256c90af3eee33cd813b483f7bee3526184880f1f6f3c03828529e37c985ccebd84
SHA51238ad74ae9fe065bf46c10e72b4d54fe78c72be3ac45de500c0253be940f30d02404544baff30d902327ca83df7cf200a3549e91538465ba49ab09a38efedf899
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms
Filesize9KB
MD5dd203ee355ddbdc770a4df53ca67efea
SHA1da4af621d726f1a6d4c3170287f2d257dffa3de2
SHA2567ee79eee9d54f1da2f2f5b0ee1d622fe20550df59b04dee0b133fa970228e200
SHA512e7ba2734ba8910ddfdd53573c4563889c5ace299f00401e8e18d6ef76ec9217a4345541ffeb0bd0447fe6b3e88b99308b5441a611754814068380ecaf47db3c4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\407962ce3d4220f.customDestinations-ms
Filesize9KB
MD55e576cbc8557792f0a5dc1ef07b6eb0d
SHA1c187ff0c518232c08c61a63e99a7def52b48548b
SHA256ef682b4a8fc2257afa96d316667a4646011724151d112b48539e0c14d23d4c9e
SHA512aba016469177c767c41bfe358907c27a7c4d8fb8e0badbb1c49061b27bb3c47d5919bf110f7e4892f3f401b5d14d9f67e86ce1cb874e3121338367ef68e71ad3
-
Filesize
22.5MB
MD50ba9bddf58c9d7763f63442efb6e30af
SHA1a5e8f717ee437118a36cde1e2d26e8dad4169622
SHA25632fe98a9a77a656afb7dd3c39b6cad1ac5222c2fc9313a8aba6ae8546f244371
SHA512a5637ad57f8b52ae2523d5443db9bc6255bd05e563b47a3f88903624751d1913b23b52c000cca93436b65876391da797bd25211c27027917864ac394b67c1298
-
Filesize
3.1MB
MD5d4a776ea55e24d3124a6e0759fb0ac44
SHA1f5932d234baccc992ca910ff12044e8965229852
SHA2567ef4d0236c81894178a6cfc6c27920217bea42a3602ad7a6002834718ba7b93c
SHA512ba9127f7f84e55a37e4eb1dc1a50d10ef044f0b24a23d451187c8d1dedec26d3a37cf78e8763b351ef1e492e26b1ef9b28fc2331591ce1b53c3d76369d100f4b
-
Filesize
3.9MB
MD5307b6a325777d94923f662b3ec2cab6c
SHA13c4aca619fb5fdf62635a903250c563a56a696c2
SHA25695838246a5303886567ad9ceed1a83b741de848a3a1b110be0ae98c9f51e3121
SHA5122444ebc8b2429b3aee66507d6f5750ba994eaa24b23765ffe7b6a4316faf5b20c9a8730875b38ee3a65828463217f8dce9655a6df58a0fd7e7c6860f881e6421
-
Filesize
871KB
MD52d2c7ee748d941798466b19b53da88bb
SHA17c0cf86f123f2896795add3ecc7bafc30fdc87bc
SHA256066dc9a1134b1db77c1574a52002f53b28cc29d0a3769bd5156d1e0e0a51a91a
SHA5129f5a9b6ce25222219f6ef07ac85e5fdf834215dcac81006629b21667aeb4ef9a809e336a66ead9fdcde0af8f51fa7d459b4875bf4023d6cee1eb189eba341912
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
1.2MB
MD506f058eee50645758a81e8842353f372
SHA115e9010bab33f1733ea41b7c45d2da5d74ed721b
SHA256854d06a90dab54e7b69882925886fb24be711fdc21884e13c77e29048b21a098
SHA512920d5b6b902a742551dd0003c3feab430c3648a36850ceecc33f5baee365bf3f938420f80695618e1ef604daf3e215112938a57f3a7f6420c286ec430e89d817
-
Filesize
2.1MB
MD504381cf1f12960ae2d748820670c4337
SHA169a4cf6ef4871644fc7eeaae4720e0d8275a215c
SHA256e82143029872c041297ec16187e17bb835504d8ee0e7baae9cdb413cd8480421
SHA512b115a10a60321b691bb60c7d257ce528b7b294cec07eec9e2bd0fd623f4762020c7ce3cbc51483dc35af3a1e552e5ca8e83f9e509caa9fd43f0c4f30719135a5
-
Filesize
270KB
MD51215366af12337d0c6df30cf1e8d8703
SHA1c068c7c67c7940a8b54f91878a41d7d563b89b52
SHA256afc14e01f32986b8fdf70abedf20a4fa4f8617197164eda2486e81960a4c82fd
SHA512159f94185a34d0f7eda4bcd7a3428a47df7bd380908a3cd2e8f3793740e2be683637279f248c78ba919e2e9eab7f1196ab6e1c3f090e51ff0b84d5e152e613fb
-
Filesize
355KB
MD557a36d4a82d48dec0b84dbead5af407a
SHA109fb2a73be8171a3d0e4fe8202c8b5aa8e0c662e
SHA256688fc87c2c8659b03a4e356b2e0d60d644b4f91865afde2edd0b431fe3e9ce6d
SHA51235cce78ec9b0fef3836b543f3737f71403cdf8d4b084f37276dd9eec63dcc958ea2e64197a09dda9bb85c69654b5d9d65992f7509c9ae542786e49867102a0c8
-
Filesize
353KB
MD5e2c7fc3a842c66f204a71680ea65be48
SHA19770bd0b297be216651330f5dada585bb9ab7280
SHA256024e34c8d8ec714e98a82a6df2de2252f2e0028f91b3ccc928f53498179a7ca2
SHA5125549a1478cd09cd00525d56dd4b162a3d42a1284c9f811037f02c6c0aed6094e6be53f7580b62226cc9eb31b8b5048435e6225ead7de996c4f3480f5852c7089
-
Filesize
163KB
MD5ee743bc7055cd46c5dc436c2e31fbb2f
SHA1bc2ecc65e2de6095306d752ad8d4005c0abf0a95
SHA256fb5355f32b99974fcce4eeaf47eb285b7a5eeed743389ef86cd781227885f7de
SHA512de549940080e22134a462061b05c19b71224f99d88748e161626c15c10b0e6dde73f614d2b73e7c667883669ef073da249066bda7344e8832f2db3f4ca771b53
-
Filesize
170KB
MD50ab8bc5e7781d4d8adf8e9042a092b01
SHA155b8f5c9eb6569684d3dcd5a9eaf307c130a9096
SHA256413516c1b9256ac6091789ab02ee8374720a8e4d3e4ff02f9dccbed707e1d5e3
SHA5120e2e3c94f7d2c7c7ee7ee8894b97e7d45fec8869ff31a6202b2316a5122570036455b4a6dfb9419c7d21d3dcc90f92bb5297b4e964469ea656b4aec82bc25226
-
Filesize
154KB
MD5d0ac42d1758fd7d7c358ad2afce07b01
SHA16714c0c29fc240f6173baaf61876836bad18ca9e
SHA25635dff5c835b1e56f004fd744c2e9c66495130bf8de1a35bb216fdd21d012d12d
SHA512e2f27b1c4463de2046b3dbb8dd0cc489ad591bdb0be2b566e1bb909c6409cb333da3905f3239a45560aaebb3ae0760dd12854b6ea1d48ec43fd2d037bcaa67bd
-
Filesize
195KB
MD5bbcf651a95a8ef4de64e68aae60739ca
SHA163c219727f867525ce1f3bec122117427ab17e74
SHA256fc081f3cbae71ad895f77ee661b8eb8d6adb7f7652ef072572f83a21024f3e52
SHA512e77bda759b5330a4084d1904273af243bf3667058eb71494f29413e0ce05dd2800eca3b6046d577a648c9e4f9c582b0b88e07312b9ef0cbc30b1732f2a371856
-
Filesize
1.0MB
MD5371ca63d32e87dc52fbeb61e32f0b5ad
SHA1ac6a727a473c6e86a940ffe5b2e159f643f14c8b
SHA256509d0da97daf68177e9ac67768bdc249069e6c524d016546413df78f96ca5b71
SHA5123273ba366d91288cfff6dcdac96f320048bb0e9eb6b721b40aa97396e04902d7d9cd3b5374314a7cad06ae1622f6de83189ce0947b6de97771f2651c3cd5f275
-
Filesize
42KB
MD544f5b5915e90e0ea92230935ffdb387a
SHA1dc8a855da4ce00d1e7fe6666ec5517f1b9251d46
SHA256b424c70cde21c207c7a0ce50c528a07916f3a23e729662399005a9c2101a4572
SHA512802100300f9227aae6e2a68c88bb8ce898f54ffeb5a1291e793fb05e8dd5eefba43cf0d8ce6729e3e2b96b8877703ef96e75ccad4bf7b7104b3c4ad98e9fb520
-
Filesize
41KB
MD59f4fd820285020cf27e98e887a86b371
SHA1d02a83746eafea50bfab3f2c376dbc7065901e6a
SHA2560211e33039e643716dae115bbaa7fe48712ffce05c5cd93e430f0920944dc0a7
SHA512f2a2e58f59878ef0a0da39f55c49eab2252d1a239a2b528e5f24141c9624ba70c7a0b116b5f7260d7642fb639ea6b02267a86d87d80b7040f01a3f77b2d30df6
-
Filesize
44KB
MD5a1d35e34f46dac72a6d9828fc684342e
SHA111e8620b430713d2a060e8b00885406406999ff5
SHA256ecde99e60a06439b6efe56449b574e4e3c72bd2866435057ea96bd95a37475b2
SHA512f3e4fca639692c375c6bc5da8add571d0321a96b108ec4b5c8c066fcd66dbc03d13466e1ee2a6999c8a3295d4dbab196e4201676d33baf23c0d7e1910005e086
-
Filesize
44KB
MD5d2f9b8a15531dbc23062d36a32f2785a
SHA1fb91c68d9169e3395d08a9e0d9206ab9eeb4a9bf
SHA256745a678f24bc4bb23fee635f7208da54c611c4dbaf3d6ced8ce506e6fcbdfb33
SHA51271cb4fd02e23f9f5ebc07b78073b33d22ad2d0f63577cb60f38b42af1da451b1738f77edfa2c77696963ffcd09d3eaf07feb69814ac20b43c65bc71b720842b3
-
Filesize
44KB
MD5c6c28c37de5679872165d8081eaae611
SHA1a6314c35d35abe6da7cc21a0cb3b3ae6cb8cd868
SHA256b6569295bbb95a2b7ef2a203cb2e6328f57afdb60d2eed7c91b9e0c140492f89
SHA512d8ebcc4edfbbba20e481e02a1abf8d135c0028abe6afd05b67748175b2683da5a22b31c19251180072e2daebf3b8ad1006d07973432844e97fab7fb141e00bd6
-
Filesize
43KB
MD55f1801d5a4313f38b0afe77780ff418e
SHA19260d0bf49fac341682e26bf333d90a02a9fd383
SHA256f220083e8127200342cc2a8b441a711f4b08fca1c0bad08f71e65fc755fd5903
SHA512833bfaa2a1c106492878e36f455dbccb592686168dc9692311423c73b9f09b3ab0df67c4248be529e72fa27bfdb1ebbeb16a3dd5d5ff56fdc29ef0f7c8511101
-
Filesize
43KB
MD59d31f68f685b47a909056410e13d9b67
SHA1ab65cf05a95d8bbc3fe4e4dcd4c5e67cd1082e4d
SHA25681891dbea99c47f2590259ce9b5a3fda7a80b7e9305dda387b2f6447eee7175b
SHA512aa7ea8c086b59690eb3ac7a2e334aaaf83e0cc1b3adbbac53b2ba04cff67392ac87d175a88ddbf5c7b53f874fda203b5360494bf628b0c563e7953dc11553907
-
Filesize
45KB
MD5c699c7cdf4be1ddd44b093e1f6ccd4ce
SHA123976f3f86117d4942e3d4010d8a2944615275c2
SHA256f8f33f39f47c9bd53ac6497cdb2c7e10b4f5aebf70dbe5c8422162047730c727
SHA512930a757630dde8659a0d3dbe8c09ddcc2d7c5295809e22e1c071b8a6e83feb9a88c66131c9d889c51636b8daa68c06ebcf32c935626fda2a5ab7630e16309f26
-
Filesize
44KB
MD5638491d6e7411ff991caf3593ba96bca
SHA114e6fb5ad4a66800fd56be8d0f2bceaeb765eaa7
SHA256964614d4e55cc2c61962777e23509aaeafcd3d78939aa148974a4b2fa574487e
SHA512245de32e72c3701cf58d4260931d4450d4bcb204c72bfc92ffc37a06c00bdb95e9231d86c47da1e2927c8ec4f4ff4fc8a2948a741729a2276f3d3fc7f48250ec
-
Filesize
42KB
MD51731e2a7c6613805d563ce6dbd7029e2
SHA1855a96774de85edb2d42ed62f4a930389020d1e2
SHA256b52ba05b0a6b87b62544b68cba8790c5d823baf93da0fff65696f3def0e02be0
SHA5129b846e535e86c2e023806235ae78ed4f68a984bf4c3c3d8779232a88dba449ad0484003b2c2563cd89bb9e022c2a3068fab90e4890614bc6f75d4847738028cb
-
Filesize
42KB
MD51bbccbbbeafa25d677e1accf13fc7e91
SHA1522cba760d745a78f9d2b1af43431b749ba525dd
SHA2568dad4dfdddb975321556a1f1b398459dac6d68d6b29ea05e96d280b256cf0109
SHA512f06b803b293a7a3e4b435a741179ccc64b41818a890a62d75dde459667c58db17b4b3a24529a654a64322777941218885a2b6e7b72e6e334386c1dfc20d0da38
-
Filesize
43KB
MD56320127c77432434e44a89e93e2a5dd7
SHA144ed93983ee3fff1cf36b12d46450106429f6174
SHA2564a02176ad398ba84f2420249e5a6afacb6bad12fcc810394d476d149bf889619
SHA512a386719934fd85b6b1d7fa5c85e5214b29d5d6daa8853096ae60c41c2f99b87fa4518406d4d6fe942bb04f650aadcf905501dd0e41eb614ab11038a12026a707
-
Filesize
45KB
MD58ca90163b756e2703eb5f92e520d4ffc
SHA11b6b24a5b2cca36c90669add9c0a0104df8aec86
SHA256ac60eece8c5458a6110eba9fe47f703828da5999408a5e9c9c689365c6e4eef3
SHA5120a38c7b95b8cfc8d17de80da77af898c395cc709a207787bda6e29681357d4c160ef11fcf80adb08558866872f34a525fd2b737f7d640d8e936cce48da8f4505
-
Filesize
42KB
MD51ca6f5c39615ef0f16976a34a47d48aa
SHA1f3983a754f6c8e857829b613d08d726b5a3de59a
SHA25649821ddc2d2af2d21fb9cd7747c618f6ce9b8fb69e110dac017b4d41ad0bddf9
SHA512715acb72219bea384115419f822290f145c89dcd35d2d5a14d14890aeb22640866806da9b01f5e6e0778fa982283481325d5d8ffa91933a976fe889c78222c73
-
Filesize
42KB
MD592e7886205eb3792cbbd3633a183cb12
SHA1216564647a07115d839c885770d1c360475279a6
SHA2562b630895ba3b973a2b1264c715b6744c277ff55031aefd4c26dc9d2360a3357a
SHA5128d1a294fa164265de6621586efba9ee775c2819d662837cb3675c4335a106db74fb8fb1758ae5bfd9c78dc799590656018a20d4448ebf2077cbe2b266f73a776
-
Filesize
43KB
MD5e45b0c0b274f1aa93d559590998c572e
SHA110f6e82ba3c00e5435b447bffdf7bf9ce48ba263
SHA256dc0a8ce05108eff46fa2a5cd629d23693c826dcff45eb86e31c4ce163fa9a465
SHA5121edf3cd05eb01a9317434218fca95839cfc5147c8d11c69a0d5c9228340e2c558fd3006b8daa821bcea20d54b2c7ecb088225ae14f8b380a4ccb43482e048136
-
Filesize
44KB
MD556cc233b80def41a589fbd52fb36626f
SHA170bf16bd33e95cfb894075c5d5ad30c3f9d39bf8
SHA256864ceeb444e065766fb0b7f0ba4938e6f56ea6fda8a62c9530657abb7fc2fa78
SHA512290fd8a5b39c8675d3d41bad0cab7410445a30adef62591d26a5da03723f86486468e3eee95926f0788fbb7959347f0e4c0db76ce7a78a22cac01817b7c44e11
-
Filesize
44KB
MD57b2bf17744445d49d1b61fe75d83e14e
SHA15402f1f0957f844420483ea3754807c4cb2cde86
SHA25644d264d2654c059b777bcd7d011024b8104c028556e2dc9cc470a80d5f3a1f9b
SHA5121b79e79168f9c1af4e736b5996c64f10fc8dc78960ebe9163b34230a11e0c9bdc58a799d963fcf31bcf87fec433e8abe88ba3f0ed01a6ea8e1f132f296bacd5d
-
Filesize
44KB
MD5d3150bd7fa51c9aba84a2fc43c440983
SHA1905c95de9153b94c4907230f16def4b214fe0385
SHA2567adfd3b65531abf14f74b5d72ae29d5baefe44d0d2ea2991f6e4c949da088a67
SHA51202bc2fc52ab74f0cb46e436570a5c099d5295b587a9952d1aa6f5e28c79b1a19d1245e05229ad5af568875d53ad2700dd97ae9a97d95d7869a4180f63da094d0
-
Filesize
43KB
MD5bcb8e81f1363784b2c47ca4c8643219f
SHA19244c30660b017edda9d3387edcfeec25875b3e5
SHA256545c1d69d3f9b1b512812dea31ad890ba95feb4ca3bbbdb98ce72a801919d116
SHA512463c77b2daaaa30a0a3260eef19068da3f6e0c2d0099d628f72d12b5e49b69ff93d48bf3fb130bddf415b5941f89d2815afc5d917bb4df39f69adebdbe59bf09
-
Filesize
43KB
MD5f6c25c1a214bb598f111cf4fa8b3400f
SHA1315786decee66575abb87c1cb23af2dd46baa0a1
SHA256a584889f453cfa9e8f9e03aa91187a00b2b1fc47161835bffa1f88423e293c3d
SHA512f5c1c8f31c9bacfab4c91ec22429f202649012aad200078ceaf207b001cefa452c5ee75b02ff076b980d4cd25fe675447ab09a61b648a640fe6a5fb58a9d0ca3
-
Filesize
43KB
MD5840e859d33976a45d9aa79b4c5160d33
SHA16522f4d21e80b7f83ab920640914dab9ac2dba5a
SHA256edc63fc935d0de9fafcb06ef7e985009653f3650e3460a6e74272aa518ae3db1
SHA5128f4c71265d0f01a88960686cceb8489eb2be2683cd6de697d4474553debd4646d9dc23f9bec53a028375f8da9cbba27dccb8b861720865b285e32bcfb0e8828a
-
Filesize
42KB
MD52bebedf7006e01182b4724cdccdf8209
SHA1d29e8371a2fd2fb5673ec26bce9a76aec61fcd0b
SHA256a57a4d3f382f02ef972dcec0b92ff766e8dff63638deba1925e4360a391202ec
SHA512605cb76437c2cc7868f88e24a09fb61d9ef81e104d1471443806c7cc31500b92d90b8f014d8aecbb85cdbbf2d9d6950e95da1d0f3ff6e6f5b195c54c17df7b1f
-
Filesize
42KB
MD51501833c6ba1afd0be75f245359aaef3
SHA15380a6501658d195008da7fe4934d3f229fce5ff
SHA25608adde568bc6e0b19da788fa5de81a5817faa7a750c926989e73f1c2be40573d
SHA512bd0ac891af264c25e264bb7562ce0ed9ed02a6d34488fd684c9cf8a4936482a072d30e1939a5042a4e10b399454804f00d45af24f2c8fbddc01653b0d90236f1
-
Filesize
44KB
MD5a70215145e52353fa80de6604ce5095d
SHA126cfcbf62d47c7830f53135f321cf559c9cf403f
SHA2569f7f4d8a0683c64a3657801cfc399ce390ba1138fd90120f49c601afc9a88cdb
SHA51227872c2cc2c0fa49146ede7e4061b3ce2322415ff8f9ff5703491c8b64ca0735207a64e520237d8174706e0e915f28862eef71a2f9d804ee02512095f87d4ab1
-
Filesize
40KB
MD5052f862b897a8e59a203ccaacd5ad09b
SHA107734dcf9c61c51389836e04e3b0125d7498b632
SHA256c1bc29fd83d244a5d20674d90e98d995a255c9dccf90881f028bf35eed8b6276
SHA512949378b1fa5ec568b99456bd475570565ea8adc01dfa387d3f87808a9c2037b82613120117e0f582bc65eb619ce7d0b2e447148236bd0262bcab5e3d475fd202
-
Filesize
39KB
MD5ee568bafe0eaef79ec54688d04816e42
SHA175c46969898fe1326a211c99ba03bdf2f42fa4ae
SHA256adbdb88fac6f4b7af1c845774e870f356aa7018ccccdd10196b10f18b9b0b2e3
SHA5122cb1568bbff7d338baeee2f5c82a003aad0e17671857afb956cc7026e19f28a1da1a5b3d3b362f0ea70bb9a1365a07445278f658aa9cab290a9e8b97ef7dbf9e
-
Filesize
44KB
MD5d876ced6baff678cbdf14031fbde9631
SHA1fda2dbeca454660ecec9ba1337b0753f89c75549
SHA2562613a42698211413ad94a5854e4e3fac172abebfebb4eac12a75a042aefa971a
SHA5121cd48b49ba164491bff2a8e3a2c5a033d4aae30b2722f601f42db7d58284be4630c8bb45f24b505cc066171a9eab7700707d4ae91a5bada2644eb1a4b36798b5
-
Filesize
39KB
MD52b67991318d781869538f48452bdb153
SHA1d008b609e56568078cfbff28b6e549f940c6fe96
SHA256520345af1b837d49bfeea54de3b7957334c998dcdac77083fd5877a494250168
SHA5121774a4bc5da769cf2f3593feabb1a5561ecb4606916d6f66b097511595a5a0718f839e55e7ec55052451c5d0f9320a3c64c43adac103c3463b3c0ff9d8cbc191
-
Filesize
42KB
MD5c3b9e9ac6cead1e698c30dbc081b89a6
SHA16ac2b98c80decf71f328a65c894365cede7f732c
SHA256da25075045e7caf14116921758ad7071abd16ca16ad30aeac51424ebe2fc8059
SHA512e4dc34f339f3a465f46d7f7cb26852e65455016d6fa1319ab4b5d04fc80a67035c87f50bbe4afcffb3b0a4912669b9b0a441325c40d0ce522d2286e794200c41
-
Filesize
43KB
MD52e67805ec1c2f327cd75145dfb6c0b4b
SHA140464bd191080fba9c7287994f0ad171c9b9d0fa
SHA2563547e9a1cdb6f0337b704754504068cda39e4075803078e37dafaf474962e71d
SHA512da12838e1151a0673a043b3eb6a8d9ddf80e62da3fa1b872cd5a0d263bbb228330bb5f29b34c37a8e00f5e28b35cfc5cb3143d3132ea10c060d2bf4bd003831b
-
Filesize
46KB
MD577247706328fc4cc32b7547b1aaa44a0
SHA183816340fa190b967a6a2a34110f822a8732e1d4
SHA2563c78a482ee4f94bf5a3cfe231ccc7d96bca83f96f621f5f6f167113e651f8aff
SHA51222347f94e900c16bef181c3cbb9518b1b2dfe27923bb108d4cd39a497d36d5c3d515eee13a027c3398130e9defb389b4d8f0cef9d2bb78932a6f04b849c85913
-
Filesize
44KB
MD5dfda61f8be51a23ea3ceb7bf9c8de9fa
SHA172f703928853390656f70426c3537a620274579c
SHA25667de42666b554a07ba14c5150bbcae7f0af8f4e082ec7e9655e6a0cff0d8e061
SHA512c5cbbc5d47bad734d8317e87e0a1efc374f8a19656531131e29e5b7c202e810def3c0cd8ccba92bd913986068020a217fdee7b48eba952d2e71ae351f20f0f6e
-
Filesize
42KB
MD5493a33c40fc499a7209f88aebe5ad0f2
SHA1ad33ae69c5e62697a19fda48639726e35a93307f
SHA2567764fd60a1f384380b7e847466690cc5ff4b46b47db86e83f766913e5219a81c
SHA5126bacb662b1a3ccef53fe2d4731b9c27639fa1194b8cebbdd2f508b2b0f96ff09b0757570f1cb46657121f462bde0e942abb1868f331448b742324d37feb248f0
-
Filesize
44KB
MD5c520f19e972feda764ec523f8bbab805
SHA1457b874fc7be37be1c46d4733b805e1c0e83bb69
SHA256e4b5d114adad2794f245a300e8a4f18cfdee78740327adc7257cff1854319f9c
SHA51274747bf5bc875a65499bbf82d60f174a6cd8af9ebb103c6a5dfadf7a002c9aa9b06a53c27beb683efe38950303543b0b0a5b1919e48ccef5d5f685d17e5c1aa2
-
Filesize
43KB
MD5db94b8ee999225ba3a038477bfcd7547
SHA1bd2beae660a1cb61eeef93feccce4c22a8cf103e
SHA256e1e4e4ce58b61260d22b464799dee32127901dfaf9ca3fb452dc1d19208989c8
SHA512d2a656d1fa36a33583c223f3fcd53238966e7114004cf36264ceb25251a822b9e3bcd298967951292afa8130d6c3190023643a356c3521495d1a9f0af3d8e00c
-
Filesize
73B
MD5d0d700d97af7329eba4106663e78eef3
SHA13edda685dd4c1784f4367145b4bc33c0931a3f52
SHA256e8d45358e5cf9c0d78c905f62747c374e28c0b3104fe63611f795271d68213f3
SHA51228c97cf9009557bdaba19edad046bbe1b0dc6b1c826402beddaa19412bf854fef8bd58f9faaa5091bcd43fa55c65bb69cbad9d2b9b222185e6a3cecddfd3650a
-
Filesize
108B
MD554fe5b510967a920d1ea789be84feda6
SHA135c9a6f3ccabee0e1e79248e740d0124a81ae5d5
SHA256f16740e1d0d02d2921f777589d1d81fa1843af65b3854fb5286e409ce9d27baf
SHA512f4d1a9ebc785cf9b27612c03347b0a0240412ca460ed078581000544f6ac607f4b46a4b3c34e134242fab37e5959522553c60f42b656d36844f7fc285d09a003
-
Filesize
564B
MD52efa37b5105fbed3014a7be8963dc2ed
SHA1a03fd940871c3a99836f8f1c3bb2edb5e5a32339
SHA2569961547296bbc34112d1c852fb61ada201f87230e56848c17af3df54ef8921b2
SHA5129b0b86e7c110b5d076d67eca5848e1847a8f04de3feb4a4c71e1d00724fad701b0b0cc3f7dba7450ab3392da4ea5e2353ac9f263b81a5a186b694b5a162db69b
-
Filesize
76B
MD54aaa0ed8099ecc1da778a9bc39393808
SHA10e4a733a5af337f101cfa6bea5ebc153380f7b05
SHA25620b91160e2611d3159ad82857323febc906457756678ab73f305c3a1e399d18d
SHA512dfa942c35e1e5f62dd8840c97693cdbfd6d71a1fd2f42e26cb75b98bb6a1818395ecdf552d46f07dff1e9c74f1493a39e05b14e3409963eff1ada88897152879
-
Filesize
533B
MD542009b4dd959e3bc13f18be4df9274fd
SHA1587ae3aa747b57ee96f44ff231efec1cc594dc97
SHA256c9e3cf0c31a16a1a4737fd30b166c6da0a74925590c75026af334c224c022f92
SHA5126a667409d99bfd69b9096fe322eac756e24a96d5a1cff2ff0ef30cbdb66b3355fb00e6914aebbd2fec35107a4e89a5b9981a030e505b8d88cc4a28a6feabc3a8
-
Filesize
107B
MD527236395ce59c88a97e8d0dcff44fc45
SHA1e55a2afedd85914131073021d5de4b64dbdbcaa8
SHA256fa0ff36fb3b2a396905448ad1a9d3d0425699424398f9b0fdeadc7c4a961f997
SHA512cba3e76fe2f3ddd71276a26adfb7aa70843bce3ec761356a6f2f3ddc601ca9158a6601b6933d5a4a7342fb92e4be80fc2c851256e85f816a5c3063f6d69aa77a
-
Filesize
563B
MD50d45b64d2fd53ca883f50b129a692590
SHA118cf77d785f43ad87e08d2e4ef47640a359431b2
SHA256cf2c438df5db4fedd73221c4f740648df37122b86b0a70afec20a4d0149e0274
SHA512dd311b5a271bcf4a56101c2bba7caa272bc95d24f456753167a1a6d42a402af122d31ff2ff6a4371315a89c2704bf9347ce67fefd41550c701afc058f5a4598f
-
Filesize
595B
MD524cbf42fa8685f11c5ab4269492f095a
SHA1acf60b533f67bd79a5738ed681d9b0d278fff9d4
SHA256370e9495fc58cf995e0449c873f507bb5711aab12a69e9021264cf5152673327
SHA512af1c14d9e9542c7432fab573d3ac906ac549d24e1c7b97a97a9e9992429d86cb07bb1de45a3461dc5a79de7e32247bffd2d1f414db7b46ba39f5765fe5ac5ea5
-
Filesize
703B
MD58961fdd3db036dd43002659a4e4a7365
SHA17b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA256c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
SHA512531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
-
Filesize
687B
MD50807cf29fc4c5d7d87c1689eb2e0baaa
SHA1d0914fb069469d47a36d339ca70164253fccf022
SHA256f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
SHA5125324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
-
Filesize
141KB
MD5677edd1a17d50f0bd11783f58725d0e7
SHA198fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA256c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
SHA512c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
-
Filesize
82B
MD52617c38bed67a4190fc499142b6f2867
SHA1a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA256d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
SHA512b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
-
Filesize
578B
MD5ccbc3b695df774121db4b320b56b0b9d
SHA19930d54099552e4df1ff0e134069e6c1b0f7334f
SHA256a200101b4ffbabae69af1fd9bb29a21986f1c5e852280d37549740f68bd82608
SHA5125cd5dbd1ca7ea7570950e7271d3246c54de366b84edc60d9c9b573d416d4dadff4d563957dc96ba23090f4a4d3643c32c86040476b40c9eebcace573b4cc8276
-
Filesize
555B
MD532c91bf9b8f95b4b2330a1b7d8b6c359
SHA132589e12e041bbc42fb3a66c489b39ef380fc1fd
SHA256cf65a918306fa7763350fd8464fd2f3a049468424b6b89b15b15d824f0796df1
SHA5122f6582a63caf1d18298b6ff9ac65172609c3444d676c5d1988d329e2dfcca5293b6cf2838dd9a6eaa655cbff403989f47fc4811b41e9a2b4c10e7478b92f384a
-
Filesize
111B
MD5fecba6c3128a97f09a1173779924be7c
SHA141645675ff089fc6059bbe1ed4b049502241e7fa
SHA2567ef57c6645a8d144047d276b5d41b153c4dc63cf3627c32db018ae64b4e6d92b
SHA512c1193abe0bb4a9359e8e73332475995bd042149f62a67e67d37549993c7130589db809c53657abb7a0f9c518f975f270debeaf7fa70327a81b8bbee233035aad
-
Filesize
76B
MD5c08a4e8fe2334119d49ca6967c23850f
SHA113c566b819d8e087246c80919e938ef2828b5dc4
SHA2565b01512276c45ecc43d4bfa9a912bdaf7afc26150881f2a0119972bffdbd8ab0
SHA512506f9f4fa4baaa4096ce10007eb09cfa95c9188082053b9ff7f2dec65164ff57506b6a8fea28d58783700f257c982aef037afc33f62da8da281e67636430dc23
-
Filesize
72B
MD5a30b19bb414d78fff00fc7855d6ed5fd
SHA12a6408f2829e964c578751bf29ec4f702412c11e
SHA2569811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f
SHA51266b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490
-
Filesize
558B
MD5f2ea88c3713fadc1cb2f57ffc5f763e5
SHA1203adbd539223c4ea2c2f0a549dd198d46bda233
SHA2563ecf70ef4593b2d7ff9955f6f62f656b1a3957b743972f1b615c91ad8b4acd62
SHA51232b8508cdb2b650abf06c6e1507769cca8cbaa99bc654d6ad528872aa1606bb66773142029f78353798c1ea73a4e2ade7c76582340b85206cda0a3de857dc212
-
Filesize
592B
MD51e0f7f890284cf0a24663ab1f9accf6e
SHA1c578e29d741313fe58e473b33cdeda91934b8209
SHA256466ec1188e845ee492a56d390648e24ab85616f7a59916499a7edcf0fe8cb300
SHA5124ddef4383afe5c21adbe343a74a67bfa204463110c538b457609e208fe5fa21968ef562dda155c5e1c1eca54b3415fd12019adf5353481d97a7ac9fd667420e7
-
Filesize
546B
MD5ccc2d62f051e67b70c72b6719493b273
SHA1f59b5076716db275b936b69c84cd661a6c42f0b3
SHA256b01ff84c07c6fbc6bcf265a56f9cb6928d62e19678eef47a5bd81f175179efa7
SHA5127712a6704965a5daca32b59c2b99336ea69555ff4df03ff3d1fc49189bab66363694e062a943f3e29fce564fd90cb5a51902473184bcf12f0c108354fc6f2623
-
Filesize
95B
MD5cd3300d7571770b1800f4505eeda0f06
SHA13f6a686d85dc53b90c1fd6724ec476fc38a87b1e
SHA256b4c780a8b36b0a034c4421ab385f5f1dfbc8a86ee876cfa4e14ad65916aa23d6
SHA512e981b7b5d3ca9ddb5dd9a402a08c7f6fe76a79a908ee8c333dd8a26fe48044e09e88139c2037ba6c1d2cd4ab244c10c8de8706652f927d9e5904fdd6f2b44eec
-
Filesize
584B
MD525b253b4d9d9ee54f5cf3cfc03a53ee2
SHA11312657bc647afc32ad202fe6c00ca479f49de1a
SHA256203e428046ed3c49cb3c05aa83f89e89ff7c342a3b63318f9e315d99cc57f9e4
SHA51218b2535136a8a7e91ecd2185265129c5e24130a6f2f7118bbd29fd5ea3b74a545ec6a635d73ea6947a68e481b72990a531ff2d66f1a75312e1820d168932d21d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82